20 files changed, 240 insertions, 132 deletions

diff --git a/third_party/nix/src/nix/build.cc b/third_party/nix/src/nix/build.cc
index 806be2b37ab4..0738821a8938 100644
--- a/third_party/nix/src/nix/build.cc
+++ b/third_party/nix/src/nix/build.cc
@@ -47,8 +47,8 @@ struct CmdBuild : MixDryRun, InstallablesCommand {
     for (size_t i = 0; i < buildables.size(); ++i) {
       auto& b(buildables[i]);
 
-      if (outLink != "")
-        for (auto& output : b.outputs)
+      if (outLink != "") {
+        for (auto& output : b.outputs) {
           if (auto store2 = store.dynamic_pointer_cast<LocalFSStore>()) {
             std::string symlink = outLink;
             if (i) {
@@ -59,6 +59,8 @@ struct CmdBuild : MixDryRun, InstallablesCommand {
             }
             store2->addPermRoot(output.second, absPath(symlink), true);
           }
+        }
+      }
     }
   }
 };
diff --git a/third_party/nix/src/nix/cat.cc b/third_party/nix/src/nix/cat.cc
index ea9fd0d942fd..9b2da929ac33 100644
--- a/third_party/nix/src/nix/cat.cc
+++ b/third_party/nix/src/nix/cat.cc
@@ -10,10 +10,12 @@ struct MixCat : virtual Args {
 
   void cat(ref<FSAccessor> accessor) {
     auto st = accessor->stat(path);
-    if (st.type == FSAccessor::Type::tMissing)
+    if (st.type == FSAccessor::Type::tMissing) {
       throw Error(format("path '%1%' does not exist") % path);
-    if (st.type != FSAccessor::Type::tRegular)
+    }
+    if (st.type != FSAccessor::Type::tRegular) {
       throw Error(format("path '%1%' is not a regular file") % path);
+    }
 
     std::cout << accessor->readFile(path);
   }
diff --git a/third_party/nix/src/nix/command.cc b/third_party/nix/src/nix/command.cc
index 4c1220668c8a..b35fb1be9898 100644
--- a/third_party/nix/src/nix/command.cc
+++ b/third_party/nix/src/nix/command.cc
@@ -14,10 +14,11 @@ void Command::printHelp(const string& programName, std::ostream& out) {
   if (!exs.empty()) {
     out << "\n";
     out << "Examples:\n";
-    for (auto& ex : exs)
+    for (auto& ex : exs) {
       out << "\n"
           << "  " << ex.description << "\n"  // FIXME: wrap
           << "  $ " << ex.command << "\n";
+    }
   }
 }
 
@@ -26,8 +27,9 @@ MultiCommand::MultiCommand(const Commands& _commands) : commands(_commands) {
       "command", 1, true, [=](std::vector<std::string> ss) {
         assert(!command);
         auto i = commands.find(ss[0]);
-        if (i == commands.end())
+        if (i == commands.end()) {
           throw UsageError("'%s' is not a recognised command", ss[0]);
+        }
         command = i->second;
       }});
 }
@@ -50,8 +52,9 @@ void MultiCommand::printHelp(const string& programName, std::ostream& out) {
   Table2 table;
   for (auto& command : commands) {
     auto descr = command.second->description();
-    if (!descr.empty())
+    if (!descr.empty()) {
       table.push_back(std::make_pair(command.second->name(), descr));
+    }
   }
   printTable(out, table);
 
@@ -72,16 +75,19 @@ bool MultiCommand::processFlag(Strings::iterator& pos, Strings::iterator end) {
 }
 
 bool MultiCommand::processArgs(const Strings& args, bool finish) {
-  if (command)
+  if (command) {
     return command->processArgs(args, finish);
-  else
+  } else {
     return Args::processArgs(args, finish);
+  }
 }
 
 StoreCommand::StoreCommand() {}
 
 ref<Store> StoreCommand::getStore() {
-  if (!_store) _store = createStore();
+  if (!_store) {
+    _store = createStore();
+  }
   return ref<Store>(_store);
 }
 
@@ -90,17 +96,18 @@ ref<Store> StoreCommand::createStore() { return openStore(); }
 void StoreCommand::run() { run(getStore()); }
 
 StorePathsCommand::StorePathsCommand(bool recursive) : recursive(recursive) {
-  if (recursive)
+  if (recursive) {
     mkFlag()
         .longName("no-recursive")
         .description("apply operation to specified paths only")
         .set(&this->recursive, false);
-  else
+  } else {
     mkFlag()
         .longName("recursive")
         .shortName('r')
         .description("apply operation to closure of the specified paths")
         .set(&this->recursive, true);
+  }
 
   mkFlag(0, "all", "apply operation to the entire store", &all);
 }
@@ -109,16 +116,18 @@ void StorePathsCommand::run(ref<Store> store) {
   Paths storePaths;
 
   if (all) {
-    if (installables.size())
+    if (installables.size()) {
       throw UsageError("'--all' does not expect arguments");
+    }
     for (auto& p : store->queryAllValidPaths()) {
       storePaths.push_back(p);
     }
   }
 
   else {
-    for (auto& p : toStorePaths(store, NoBuild, installables))
+    for (auto& p : toStorePaths(store, NoBuild, installables)) {
       storePaths.push_back(p);
+    }
 
     if (recursive) {
       PathSet closure;
@@ -134,8 +143,9 @@ void StorePathsCommand::run(ref<Store> store) {
 void StorePathCommand::run(ref<Store> store) {
   auto storePaths = toStorePaths(store, NoBuild, installables);
 
-  if (storePaths.size() != 1)
+  if (storePaths.size() != 1) {
     throw UsageError("this command requires exactly one store path");
+  }
 
   run(store, *storePaths.begin());
 }
diff --git a/third_party/nix/src/nix/copy.cc b/third_party/nix/src/nix/copy.cc
index fe5e37363c30..633fe399b48c 100644
--- a/third_party/nix/src/nix/copy.cc
+++ b/third_party/nix/src/nix/copy.cc
@@ -72,8 +72,9 @@ struct CmdCopy : StorePathsCommand {
   }
 
   void run(ref<Store> srcStore, Paths storePaths) override {
-    if (srcUri.empty() && dstUri.empty())
+    if (srcUri.empty() && dstUri.empty()) {
       throw UsageError("you must pass '--from' and/or '--to'");
+    }
 
     ref<Store> dstStore = dstUri.empty() ? openStore() : openStore(dstUri);
 
diff --git a/third_party/nix/src/nix/doctor.cc b/third_party/nix/src/nix/doctor.cc
index cf59aabdbda6..44ce2d92921d 100644
--- a/third_party/nix/src/nix/doctor.cc
+++ b/third_party/nix/src/nix/doctor.cc
@@ -44,9 +44,11 @@ struct CmdDoctor : StoreCommand {
   bool checkNixInPath() {
     PathSet dirs;
 
-    for (auto& dir : tokenizeString<Strings>(getEnv("PATH"), ":"))
-      if (pathExists(dir + "/nix-env"))
+    for (auto& dir : tokenizeString<Strings>(getEnv("PATH"), ":")) {
+      if (pathExists(dir + "/nix-env")) {
         dirs.insert(dirOf(canonPath(dir + "/nix-env", true)));
+      }
+    }
 
     if (dirs.size() != 1) {
       std::cout << "Warning: multiple versions of nix found in PATH."
@@ -73,11 +75,13 @@ struct CmdDoctor : StoreCommand {
         if (store->isStorePath(userEnv) &&
             hasSuffix(userEnv, "user-environment")) {
           while (profileDir.find("/profiles/") == std::string::npos &&
-                 isLink(profileDir))
+                 isLink(profileDir)) {
             profileDir = absPath(readLink(profileDir), dirOf(profileDir));
+          }
 
-          if (profileDir.find("/profiles/") == std::string::npos)
+          if (profileDir.find("/profiles/") == std::string::npos) {
             dirs.insert(dir);
+          }
         }
       } catch (SysError&) {
       }
diff --git a/third_party/nix/src/nix/edit.cc b/third_party/nix/src/nix/edit.cc
index 61d700592b76..01c2ec7ef0d8 100644
--- a/third_party/nix/src/nix/edit.cc
+++ b/third_party/nix/src/nix/edit.cc
@@ -40,8 +40,9 @@ struct CmdEdit : InstallableCommand {
     DLOG(INFO) << "position is " << pos;
 
     auto colon = pos.rfind(':');
-    if (colon == std::string::npos)
+    if (colon == std::string::npos) {
       throw Error("cannot parse meta.position attribute '%s'", pos);
+    }
 
     std::string filename(pos, 0, colon);
     int lineno;
@@ -57,8 +58,9 @@ struct CmdEdit : InstallableCommand {
 
     if (editor.find("emacs") != std::string::npos ||
         editor.find("nano") != std::string::npos ||
-        editor.find("vim") != std::string::npos)
+        editor.find("vim") != std::string::npos) {
       args.push_back(fmt("+%d", lineno));
+    }
 
     args.push_back(filename);
 
diff --git a/third_party/nix/src/nix/eval.cc b/third_party/nix/src/nix/eval.cc
index d84b86bc531e..661d587d7385 100644
--- a/third_party/nix/src/nix/eval.cc
+++ b/third_party/nix/src/nix/eval.cc
@@ -32,8 +32,9 @@ struct CmdEval : MixJSON, InstallableCommand {
   }
 
   void run(ref<Store> store) override {
-    if (raw && json)
+    if (raw && json) {
       throw UsageError("--raw and --json are mutually exclusive");
+    }
 
     auto state = getEvalState();
 
diff --git a/third_party/nix/src/nix/hash.cc b/third_party/nix/src/nix/hash.cc
index 77be77cfcdc0..39780532f842 100644
--- a/third_party/nix/src/nix/hash.cc
+++ b/third_party/nix/src/nix/hash.cc
@@ -73,8 +73,9 @@ struct CmdToBase : Command {
   }
 
   void run() override {
-    for (auto s : args)
+    for (auto s : args) {
       std::cout << fmt("%s\n", Hash(s, ht).to_string(base, base == SRI));
+    }
   }
 };
 
@@ -94,29 +95,31 @@ static int compatNixHash(int argc, char** argv) {
 
   parseCmdLine(argc, argv,
                [&](Strings::iterator& arg, const Strings::iterator& end) {
-                 if (*arg == "--help")
+                 if (*arg == "--help") {
                    showManPage("nix-hash");
-                 else if (*arg == "--version")
+                 } else if (*arg == "--version") {
                    printVersion("nix-hash");
-                 else if (*arg == "--flat")
+                 } else if (*arg == "--flat") {
                    flat = true;
-                 else if (*arg == "--base32")
+                 } else if (*arg == "--base32") {
                    base32 = true;
-                 else if (*arg == "--truncate")
+                 } else if (*arg == "--truncate") {
                    truncate = true;
-                 else if (*arg == "--type") {
+                 } else if (*arg == "--type") {
                    string s = getArg(*arg, arg, end);
                    ht = parseHashType(s);
-                   if (ht == htUnknown)
+                   if (ht == htUnknown) {
                      throw UsageError(format("unknown hash type '%1%'") % s);
-                 } else if (*arg == "--to-base16")
+                   }
+                 } else if (*arg == "--to-base16") {
                    op = opTo16;
-                 else if (*arg == "--to-base32")
+                 } else if (*arg == "--to-base32") {
                    op = opTo32;
-                 else if (*arg != "" && arg->at(0) == '-')
+                 } else if (*arg != "" && arg->at(0) == '-') {
                    return false;
-                 else
+                 } else {
                    ss.push_back(*arg);
+                 }
                  return true;
                });
 
diff --git a/third_party/nix/src/nix/installables.cc b/third_party/nix/src/nix/installables.cc
index f400841b7c48..8a7de8655bef 100644
--- a/third_party/nix/src/nix/installables.cc
+++ b/third_party/nix/src/nix/installables.cc
@@ -30,10 +30,10 @@ Value* SourceExprCommand::getSourceExpr(EvalState& state) {
 
   vSourceExpr = state.allocValue();
 
-  if (file != "")
+  if (file != "") {
     state.evalFile(lookupFileArg(state, file), *vSourceExpr);
 
-  else {
+  } else {
     /* Construct the installation source from $NIX_PATH. */
 
     auto searchPath = state.getSearchPath();
@@ -60,14 +60,18 @@ Value* SourceExprCommand::getSourceExpr(EvalState& state) {
             state.getBuiltin("import"), *v2);
     };
 
-    for (auto& i : searchPath) /* Hack to handle channels. */
+    for (auto& i : searchPath) { /* Hack to handle channels. */
       if (i.first.empty() && pathExists(i.second + "/manifest.nix")) {
-        for (auto& j : readDirectory(i.second))
+        for (auto& j : readDirectory(i.second)) {
           if (j.name != "manifest.nix" &&
-              pathExists(fmt("%s/%s/default.nix", i.second, j.name)))
+              pathExists(fmt("%s/%s/default.nix", i.second, j.name))) {
             addEntry(j.name);
-      } else
+          }
+        }
+      } else {
         addEntry(i.first);
+      }
+    }
 
     vSourceExpr->attrs->sort();
   }
@@ -76,18 +80,20 @@ Value* SourceExprCommand::getSourceExpr(EvalState& state) {
 }
 
 ref<EvalState> SourceExprCommand::getEvalState() {
-  if (!evalState)
+  if (!evalState) {
     evalState = std::make_shared<EvalState>(searchPath, getStore());
+  }
   return ref<EvalState>(evalState);
 }
 
 Buildable Installable::toBuildable() {
   auto buildables = toBuildables();
-  if (buildables.size() != 1)
+  if (buildables.size() != 1) {
     throw Error(
         "installable '%s' evaluates to %d derivations, where only one is "
         "expected",
         what(), buildables.size());
+  }
   return std::move(buildables[0]);
 }
 
@@ -127,9 +133,10 @@ struct InstallableValue : Installable {
       drvPaths.insert(b.drvPath);
 
       auto outputName = drv.queryOutputName();
-      if (outputName == "")
+      if (outputName == "") {
         throw Error("derivation '%s' lacks an 'outputName' attribute",
                     b.drvPath);
+      }
 
       b.outputs.emplace(outputName, drv.queryOutPath());
 
@@ -140,11 +147,13 @@ struct InstallableValue : Installable {
     // merge the buildables.
     if (drvPaths.size() == 1) {
       Buildable b{*drvPaths.begin()};
-      for (auto& b2 : res)
+      for (auto& b2 : res) {
         b.outputs.insert(b2.outputs.begin(), b2.outputs.end());
+      }
       return {b};
-    } else
+    } else {
       return res;
+    }
   }
 };
 
@@ -200,21 +209,23 @@ static std::vector<std::shared_ptr<Installable>> parseInstallables(
   }
 
   for (auto& s : ss) {
-    if (s.compare(0, 1, "(") == 0)
+    if (s.compare(0, 1, "(") == 0) {
       result.push_back(std::make_shared<InstallableExpr>(cmd, s));
 
-    else if (s.find("/") != std::string::npos) {
+    } else if (s.find("/") != std::string::npos) {
       auto path = store->toStorePath(store->followLinksToStore(s));
 
-      if (store->isStorePath(path))
+      if (store->isStorePath(path)) {
         result.push_back(std::make_shared<InstallableStorePath>(path));
+      }
     }
 
-    else if (s == "" || std::regex_match(s, attrPathRegex))
+    else if (s == "" || std::regex_match(s, attrPathRegex)) {
       result.push_back(std::make_shared<InstallableAttrPath>(cmd, s));
 
-    else
+    } else {
       throw UsageError("don't know what to do with argument '%s'", s);
+    }
   }
 
   return result;
@@ -248,10 +259,11 @@ Buildables build(ref<Store> store, RealiseMode mode,
         }
         pathsToBuild.insert(b.drvPath + "!" +
                             concatStringsSep(",", outputNames));
-      } else
+      } else {
         for (auto& output : b.outputs) {
           pathsToBuild.insert(output.second);
         }
+      }
       buildables.push_back(std::move(b));
     }
   }
@@ -269,10 +281,11 @@ PathSet toStorePaths(ref<Store> store, RealiseMode mode,
                      std::vector<std::shared_ptr<Installable>> installables) {
   PathSet outPaths;
 
-  for (auto& b : build(store, mode, installables))
+  for (auto& b : build(store, mode, installables)) {
     for (auto& output : b.outputs) {
       outPaths.insert(output.second);
     }
+  }
 
   return outPaths;
 }
@@ -281,9 +294,10 @@ Path toStorePath(ref<Store> store, RealiseMode mode,
                  std::shared_ptr<Installable> installable) {
   auto paths = toStorePaths(store, mode, {installable});
 
-  if (paths.size() != 1)
+  if (paths.size() != 1) {
     throw Error("argument '%s' should evaluate to one store path",
                 installable->what());
+  }
 
   return *paths.begin();
 }
@@ -293,22 +307,26 @@ PathSet toDerivations(ref<Store> store,
                       bool useDeriver) {
   PathSet drvPaths;
 
-  for (auto& i : installables)
+  for (auto& i : installables) {
     for (auto& b : i->toBuildables()) {
       if (b.drvPath.empty()) {
-        if (!useDeriver)
+        if (!useDeriver) {
           throw Error("argument '%s' did not evaluate to a derivation",
                       i->what());
+        }
         for (auto& output : b.outputs) {
           auto derivers = store->queryValidDerivers(output.second);
-          if (derivers.empty())
+          if (derivers.empty()) {
             throw Error("'%s' does not have a known deriver", i->what());
+          }
           // FIXME: use all derivers?
           drvPaths.insert(*derivers.begin());
         }
-      } else
+      } else {
         drvPaths.insert(b.drvPath);
+      }
     }
+  }
 
   return drvPaths;
 }
diff --git a/third_party/nix/src/nix/ls.cc b/third_party/nix/src/nix/ls.cc
index 62720b93a0ce..13b7bbbbb9bd 100644
--- a/third_party/nix/src/nix/ls.cc
+++ b/third_party/nix/src/nix/ls.cc
@@ -35,17 +35,20 @@ struct MixLs : virtual Args, MixJSON {
                                    ? "lrwxrwxrwx"
                                    : "dr-xr-xr-x";
         std::cout << (format("%s %20d %s") % tp % st.fileSize % relPath);
-        if (st.type == FSAccessor::Type::tSymlink)
+        if (st.type == FSAccessor::Type::tSymlink) {
           std::cout << " -> " << accessor->readLink(curPath);
+        }
         std::cout << "\n";
-        if (recursive && st.type == FSAccessor::Type::tDirectory)
+        if (recursive && st.type == FSAccessor::Type::tDirectory) {
           doPath(st, curPath, relPath, false);
+        }
       } else {
         std::cout << relPath << "\n";
         if (recursive) {
           auto st = accessor->stat(curPath);
-          if (st.type == FSAccessor::Type::tDirectory)
+          if (st.type == FSAccessor::Type::tDirectory) {
             doPath(st, curPath, relPath, false);
+          }
         }
       }
     };
@@ -57,8 +60,9 @@ struct MixLs : virtual Args, MixJSON {
         for (auto& name : names) {
           showFile(curPath + "/" + name, relPath + "/" + name);
         }
-      } else
+      } else {
         showFile(curPath, relPath);
+      }
     };
 
     auto st = accessor->stat(path);
diff --git a/third_party/nix/src/nix/main.cc b/third_party/nix/src/nix/main.cc
index 9dbe9b155bf2..23bc62887a88 100644
--- a/third_party/nix/src/nix/main.cc
+++ b/third_party/nix/src/nix/main.cc
@@ -44,8 +44,9 @@ static bool haveInternet() {
       }
     } else if (i->ifa_addr->sa_family == AF_INET6) {
       if (!IN6_IS_ADDR_LOOPBACK(&((sockaddr_in6*)i->ifa_addr)->sin6_addr) &&
-          !IN6_IS_ADDR_LINKLOCAL(&((sockaddr_in6*)i->ifa_addr)->sin6_addr))
+          !IN6_IS_ADDR_LINKLOCAL(&((sockaddr_in6*)i->ifa_addr)->sin6_addr)) {
         return true;
+      }
     }
   }
 
@@ -72,8 +73,9 @@ struct NixArgs : virtual MultiCommand, virtual MixCommonArgs {
           Table2 tbl;
           std::map<std::string, Config::SettingInfo> settings;
           globalConfig.getSettings(settings);
-          for (const auto& s : settings)
+          for (const auto& s : settings) {
             tbl.emplace_back(s.first, s.second.description);
+          }
           printTable(std::cout, tbl);
           throw Exit();
         });
@@ -159,13 +161,15 @@ void mainWrapped(int argc, char** argv) {
     if (!settings.useSubstitutes.overriden) {
       settings.useSubstitutes = false;
     }
-    if (!settings.tarballTtl.overriden)
+    if (!settings.tarballTtl.overriden) {
       settings.tarballTtl = std::numeric_limits<unsigned int>::max();
+    }
     if (!downloadSettings.tries.overriden) {
       downloadSettings.tries = 0;
     }
-    if (!downloadSettings.connectTimeout.overriden)
+    if (!downloadSettings.connectTimeout.overriden) {
       downloadSettings.connectTimeout = 1;
+    }
   }
 
   args.command->prepare();
diff --git a/third_party/nix/src/nix/path-info.cc b/third_party/nix/src/nix/path-info.cc
index 9f155231d440..b871c45f1c16 100644
--- a/third_party/nix/src/nix/path-info.cc
+++ b/third_party/nix/src/nix/path-info.cc
@@ -75,8 +75,9 @@ struct CmdPathInfo : StorePathsCommand, MixJSON {
 
   void run(ref<Store> store, Paths storePaths) override {
     size_t pathLen = 0;
-    for (auto& storePath : storePaths)
+    for (auto& storePath : storePaths) {
       pathLen = std::max(pathLen, storePath.size());
+    }
 
     if (json) {
       JSONPlaceholder jsonRoot(std::cout);
@@ -93,9 +94,10 @@ struct CmdPathInfo : StorePathsCommand, MixJSON {
 
         std::cout << storePath;
 
-        if (showSize || showClosureSize || showSigs)
+        if (showSize || showClosureSize || showSigs) {
           std::cout << std::string(
               std::max(0, (int)pathLen - (int)storePath.size()), ' ');
+        }
 
         if (showSize) {
           printSize(info->narSize);
diff --git a/third_party/nix/src/nix/repl.cc b/third_party/nix/src/nix/repl.cc
index f6b62d0ca2d2..80921f77dcfb 100644
--- a/third_party/nix/src/nix/repl.cc
+++ b/third_party/nix/src/nix/repl.cc
@@ -181,8 +181,9 @@ static char* completionCallback(char* s, int* match) {
 static int listPossibleCallback(char* s, char*** avp) {
   auto possible = curRepl->completePrefix(s);
 
-  if (possible.size() > (INT_MAX / sizeof(char*)))
+  if (possible.size() > (INT_MAX / sizeof(char*))) {
     throw Error("too many completions");
+  }
 
   int ac = 0;
   char** vp = nullptr;
@@ -190,7 +191,9 @@ static int listPossibleCallback(char* s, char*** avp) {
   auto check = [&](auto* p) {
     if (!p) {
       if (vp) {
-        while (--ac >= 0) free(vp[ac]);
+        while (--ac >= 0) {
+          free(vp[ac]);
+        }
         free(vp);
       }
       throw Error("allocation failure");
@@ -288,20 +291,24 @@ bool NixRepl::getLine(string& input, const std::string& prompt) {
     act.sa_handler = sigintHandler;
     sigfillset(&act.sa_mask);
     act.sa_flags = 0;
-    if (sigaction(SIGINT, &act, &old))
+    if (sigaction(SIGINT, &act, &old)) {
       throw SysError("installing handler for SIGINT");
+    }
 
     sigemptyset(&set);
     sigaddset(&set, SIGINT);
-    if (sigprocmask(SIG_UNBLOCK, &set, &savedSignalMask))
+    if (sigprocmask(SIG_UNBLOCK, &set, &savedSignalMask)) {
       throw SysError("unblocking SIGINT");
+    }
   };
   auto restoreSignals = [&]() {
-    if (sigprocmask(SIG_SETMASK, &savedSignalMask, nullptr))
+    if (sigprocmask(SIG_SETMASK, &savedSignalMask, nullptr)) {
       throw SysError("restoring signals");
+    }
 
-    if (sigaction(SIGINT, &old, 0))
+    if (sigaction(SIGINT, &old, 0)) {
       throw SysError("restoring handler for SIGINT");
+    }
   };
 
   setupSignals();
@@ -343,8 +350,9 @@ StringSet NixRepl::completePrefix(string prefix) {
       auto dir = std::string(cur, 0, slash);
       auto prefix2 = std::string(cur, slash + 1);
       for (auto& entry : readDirectory(dir == "" ? "/" : dir)) {
-        if (entry.name[0] != '.' && hasPrefix(entry.name, prefix2))
+        if (entry.name[0] != '.' && hasPrefix(entry.name, prefix2)) {
           completions.insert(prev + dir + "/" + entry.name);
+        }
       }
     } catch (Error&) {
     }
@@ -417,21 +425,25 @@ bool isVarName(const string& s) {
   if ((c >= '0' && c <= '9') || c == '-' || c == '\'') {
     return false;
   }
-  for (auto& i : s)
+  for (auto& i : s) {
     if (!((i >= 'a' && i <= 'z') || (i >= 'A' && i <= 'Z') ||
-          (i >= '0' && i <= '9') || i == '_' || i == '-' || i == '\''))
+          (i >= '0' && i <= '9') || i == '_' || i == '-' || i == '\'')) {
       return false;
+    }
+  }
   return true;
 }
 
 Path NixRepl::getDerivationPath(Value& v) {
   auto drvInfo = getDerivation(state, v, false);
-  if (!drvInfo)
+  if (!drvInfo) {
     throw Error(
         "expression does not evaluate to a derivation, so I can't build it");
+  }
   Path drvPath = drvInfo->queryDrvPath();
-  if (drvPath == "" || !state.store->isValidPath(drvPath))
+  if (drvPath == "" || !state.store->isValidPath(drvPath)) {
     throw Error("expression did not evaluate to a valid derivation");
+  }
   return drvPath;
 }
 
@@ -520,9 +532,10 @@ bool NixRepl::processLine(string line) {
         std::cout << std::endl
                   << "this derivation produced the following outputs:"
                   << std::endl;
-        for (auto& i : drv.outputs)
+        for (auto& i : drv.outputs) {
           std::cout << format("  %1% -> %2%") % i.first % i.second.path
                     << std::endl;
+        }
       }
     } else if (command == ":i") {
       runProgram(settings.nixBinDir + "/nix-env", Strings{"-i", drvPath});
@@ -537,13 +550,13 @@ bool NixRepl::processLine(string line) {
     printValue(std::cout, v, 1000000000) << std::endl;
   }
 
-  else if (command == ":q" || command == ":quit")
+  else if (command == ":q" || command == ":quit") {
     return false;
 
-  else if (command != "")
+  } else if (command != "") {
     throw Error(format("unknown command '%1%'") % command);
 
-  else {
+  } else {
     size_t p = line.find('=');
     string name;
     if (p != string::npos && p < line.size() && line[p + 1] != '=' &&
@@ -612,8 +625,9 @@ void NixRepl::addAttrsToScope(Value& attrs) {
 }
 
 void NixRepl::addVarToScope(const Symbol& name, Value& v) {
-  if (displ >= envSize)
+  if (displ >= envSize) {
     throw Error("environment full; cannot add more variables");
+  }
   staticEnv.vars[name] = displ;
   env->values[displ++] = &v;
   varNames.insert((string)name);
@@ -638,17 +652,19 @@ std::ostream& NixRepl::printValue(std::ostream& str, Value& v,
 
 std::ostream& printStringValue(std::ostream& str, const char* string) {
   str << "\"";
-  for (const char* i = string; *i; i++)
-    if (*i == '\"' || *i == '\\')
+  for (const char* i = string; *i; i++) {
+    if (*i == '\"' || *i == '\\') {
       str << "\\" << *i;
-    else if (*i == '\n')
+    } else if (*i == '\n') {
       str << "\\n";
-    else if (*i == '\r')
+    } else if (*i == '\r') {
       str << "\\r";
-    else if (*i == '\t')
+    } else if (*i == '\t') {
       str << "\\t";
-    else
+    } else {
       str << *i;
+    }
+  }
   str << "\"";
   return str;
 }
@@ -709,19 +725,21 @@ std::ostream& NixRepl::printValue(std::ostream& str, Value& v,
         }
 
         for (auto& i : sorted) {
-          if (isVarName(i.first))
+          if (isVarName(i.first)) {
             str << i.first;
-          else
+          } else {
             printStringValue(str, i.first.c_str());
+          }
           str << " = ";
-          if (seen.find(i.second) != seen.end())
+          if (seen.find(i.second) != seen.end()) {
             str << "«repeated»";
-          else
+          } else {
             try {
               printValue(str, *i.second, maxDepth - 1, seen);
             } catch (AssertionError& e) {
               str << ESC_RED "«error: " << e.msg() << "»" ESC_END;
             }
+          }
           str << "; ";
         }
 
@@ -741,14 +759,15 @@ std::ostream& NixRepl::printValue(std::ostream& str, Value& v,
       str << "[ ";
       if (maxDepth > 0) {
         for (unsigned int n = 0; n < v.listSize(); ++n) {
-          if (seen.find(v.listElems()[n]) != seen.end())
+          if (seen.find(v.listElems()[n]) != seen.end()) {
             str << "«repeated»";
-          else
+          } else {
             try {
               printValue(str, *v.listElems()[n], maxDepth - 1, seen);
             } catch (AssertionError& e) {
               str << ESC_RED "«error: " << e.msg() << "»" ESC_END;
             }
+          }
           str << " ";
         }
       } else {
diff --git a/third_party/nix/src/nix/run.cc b/third_party/nix/src/nix/run.cc
index 64b883b9a316..523aa87472d6 100644
--- a/third_party/nix/src/nix/run.cc
+++ b/third_party/nix/src/nix/run.cc
@@ -31,8 +31,9 @@ struct CmdRun : InstallablesCommand {
         .labels({"command", "args"})
         .arity(ArityAny)
         .handler([&](std::vector<std::string> ss) {
-          if (ss.empty())
+          if (ss.empty()) {
             throw UsageError("--command requires at least one argument");
+          }
           command = ss;
         });
 
@@ -87,9 +88,10 @@ struct CmdRun : InstallablesCommand {
     auto accessor = store->getFSAccessor();
 
     if (ignoreEnvironment) {
-      if (!unset.empty())
+      if (!unset.empty()) {
         throw UsageError(
             "--unset does not make sense with --ignore-environment");
+      }
 
       std::map<std::string, std::string> kept;
       for (auto& var : keep) {
@@ -106,9 +108,10 @@ struct CmdRun : InstallablesCommand {
       }
 
     } else {
-      if (!keep.empty())
+      if (!keep.empty()) {
         throw UsageError(
             "--keep does not make sense without --ignore-environment");
+      }
 
       for (auto& var : unset) {
         unsetenv(var.c_str());
@@ -191,17 +194,21 @@ void chrootHelper(int argc, char** argv) {
   std::string realStoreDir = argv[p++];
   std::string cmd = argv[p++];
   Strings args;
-  while (p < argc) args.push_back(argv[p++]);
+  while (p < argc) {
+    args.push_back(argv[p++]);
+  }
 
 #if __linux__
   uid_t uid = getuid();
   uid_t gid = getgid();
 
-  if (unshare(CLONE_NEWUSER | CLONE_NEWNS) == -1)
+  if (unshare(CLONE_NEWUSER | CLONE_NEWNS) == -1) {
     /* Try with just CLONE_NEWNS in case user namespaces are
        specifically disabled. */
-    if (unshare(CLONE_NEWNS) == -1)
+    if (unshare(CLONE_NEWNS) == -1) {
       throw SysError("setting up a private mount namespace");
+    }
+  }
 
   /* Bind-mount realStoreDir on /nix/store. If the latter mount
      point doesn't already exists, we have to create a chroot
@@ -218,8 +225,9 @@ void chrootHelper(int argc, char** argv) {
     createDirs(tmpDir + storeDir);
 
     if (mount(realStoreDir.c_str(), (tmpDir + storeDir).c_str(), "", MS_BIND,
-              0) == -1)
+              0) == -1) {
       throw SysError("mounting '%s' on '%s'", realStoreDir, storeDir);
+    }
 
     for (auto entry : readDirectory("/")) {
       auto src = "/" + entry.name;
@@ -231,10 +239,12 @@ void chrootHelper(int argc, char** argv) {
       if (pathExists(dst)) {
         continue;
       }
-      if (mkdir(dst.c_str(), 0700) == -1)
+      if (mkdir(dst.c_str(), 0700) == -1) {
         throw SysError("creating directory '%s'", dst);
-      if (mount(src.c_str(), dst.c_str(), "", MS_BIND | MS_REC, 0) == -1)
+      }
+      if (mount(src.c_str(), dst.c_str(), "", MS_BIND | MS_REC, 0) == -1) {
         throw SysError("mounting '%s' on '%s'", src, dst);
+      }
     }
 
     char* cwd = getcwd(0, 0);
@@ -243,14 +253,17 @@ void chrootHelper(int argc, char** argv) {
     }
     Finally freeCwd([&]() { free(cwd); });
 
-    if (chroot(tmpDir.c_str()) == -1)
+    if (chroot(tmpDir.c_str()) == -1) {
       throw SysError(format("chrooting into '%s'") % tmpDir);
+    }
 
-    if (chdir(cwd) == -1)
+    if (chdir(cwd) == -1) {
       throw SysError(format("chdir to '%s' in chroot") % cwd);
+    }
   } else if (mount(realStoreDir.c_str(), storeDir.c_str(), "", MS_BIND, 0) ==
-             -1)
+             -1) {
     throw SysError("mounting '%s' on '%s'", realStoreDir, storeDir);
+  }
 
   writeFile("/proc/self/setgroups", "deny");
   writeFile("/proc/self/uid_map", fmt("%d %d %d", uid, uid, 1));
diff --git a/third_party/nix/src/nix/search.cc b/third_party/nix/src/nix/search.cc
index 994fccd5642f..5978d197fec6 100644
--- a/third_party/nix/src/nix/search.cc
+++ b/third_party/nix/src/nix/search.cc
@@ -251,13 +251,15 @@ struct CmdSearch : SourceExprCommand, MixJSON {
       }
 
       if (writeCache &&
-          rename(tmpFile.c_str(), jsonCacheFileName.c_str()) == -1)
+          rename(tmpFile.c_str(), jsonCacheFileName.c_str()) == -1) {
         throw SysError("cannot rename '%s' to '%s'", tmpFile,
                        jsonCacheFileName);
+      }
     }
 
-    if (results.size() == 0)
+    if (results.size() == 0) {
       throw Error("no results for the given search term(s)!");
+    }
 
     RunPager pager;
     for (auto el : results) {
diff --git a/third_party/nix/src/nix/show-config.cc b/third_party/nix/src/nix/show-config.cc
index dba94732a9c3..85b3c330cddb 100644
--- a/third_party/nix/src/nix/show-config.cc
+++ b/third_party/nix/src/nix/show-config.cc
@@ -21,8 +21,9 @@ struct CmdShowConfig : Command, MixJSON {
     } else {
       std::map<std::string, Config::SettingInfo> settings;
       globalConfig.getSettings(settings);
-      for (auto& s : settings)
+      for (auto& s : settings) {
         std::cout << s.first + " = " + s.second.value + "\n";
+      }
     }
   }
 };
diff --git a/third_party/nix/src/nix/sigs.cc b/third_party/nix/src/nix/sigs.cc
index 0eb16b682973..eb99fc8ee581 100644
--- a/third_party/nix/src/nix/sigs.cc
+++ b/third_party/nix/src/nix/sigs.cc
@@ -31,8 +31,9 @@ struct CmdCopySigs : StorePathsCommand {
   }
 
   void run(ref<Store> store, Paths storePaths) override {
-    if (substituterUris.empty())
+    if (substituterUris.empty()) {
       throw UsageError("you must specify at least one substituter using '-s'");
+    }
 
     // FIXME: factor out commonality with MixVerify.
     std::vector<ref<Store>> substituters;
@@ -65,13 +66,15 @@ struct CmdCopySigs : StorePathsCommand {
              binary. */
           if (info->narHash != info2->narHash ||
               info->narSize != info2->narSize ||
-              info->references != info2->references)
+              info->references != info2->references) {
             continue;
+          }
 
-          for (auto& sig : info2->sigs)
+          for (auto& sig : info2->sigs) {
             if (!info->sigs.count(sig)) {
               newSigs.insert(sig);
             }
+          }
         } catch (InvalidPath&) {
         }
       }
@@ -84,8 +87,9 @@ struct CmdCopySigs : StorePathsCommand {
       // logger->incProgress(doneLabel);
     };
 
-    for (auto& storePath : storePaths)
+    for (auto& storePath : storePaths) {
       pool.enqueue(std::bind(doPath, storePath));
+    }
 
     pool.process();
 
@@ -112,8 +116,9 @@ struct CmdSignPaths : StorePathsCommand {
   std::string description() override { return "sign the specified paths"; }
 
   void run(ref<Store> store, Paths storePaths) override {
-    if (secretKeyFile.empty())
+    if (secretKeyFile.empty()) {
       throw UsageError("you must specify a secret key file using '-k'");
+    }
 
     SecretKey secretKey(readFile(secretKeyFile));
 
diff --git a/third_party/nix/src/nix/upgrade-nix.cc b/third_party/nix/src/nix/upgrade-nix.cc
index 277d761ec581..dd11da0087c7 100644
--- a/third_party/nix/src/nix/upgrade-nix.cc
+++ b/third_party/nix/src/nix/upgrade-nix.cc
@@ -80,8 +80,9 @@ struct CmdUpgradeNix : MixDryRun, StoreCommand {
       LOG(INFO) << "verifying that '" << storePath << "' works...";
       auto program = storePath + "/bin/nix-env";
       auto s = runProgram(program, false, {"--version"});
-      if (s.find("Nix") == std::string::npos)
+      if (s.find("Nix") == std::string::npos) {
         throw Error("could not verify that '%s' works", program);
+      }
     }
 
     {
@@ -99,15 +100,17 @@ struct CmdUpgradeNix : MixDryRun, StoreCommand {
   Path getProfileDir(ref<Store> store) {
     Path where;
 
-    for (auto& dir : tokenizeString<Strings>(getEnv("PATH"), ":"))
+    for (auto& dir : tokenizeString<Strings>(getEnv("PATH"), ":")) {
       if (pathExists(dir + "/nix-env")) {
         where = dir;
         break;
       }
+    }
 
-    if (where == "")
+    if (where == "") {
       throw Error(
           "couldn't figure out how Nix is installed, so I can't upgrade it");
+    }
 
     LOG(INFO) << "found Nix in '" << where << "'";
 
@@ -119,19 +122,22 @@ struct CmdUpgradeNix : MixDryRun, StoreCommand {
 
     // Resolve profile to /nix/var/nix/profiles/<name> link.
     while (canonPath(profileDir).find("/profiles/") == std::string::npos &&
-           isLink(profileDir))
+           isLink(profileDir)) {
       profileDir = readLink(profileDir);
+    }
 
     LOG(INFO) << "found profile '" << profileDir << "'";
 
     Path userEnv = canonPath(profileDir, true);
 
-    if (baseNameOf(where) != "bin" || !hasSuffix(userEnv, "user-environment"))
+    if (baseNameOf(where) != "bin" || !hasSuffix(userEnv, "user-environment")) {
       throw Error("directory '%s' does not appear to be part of a Nix profile",
                   where);
+    }
 
-    if (!store->isValidPath(userEnv))
+    if (!store->isValidPath(userEnv)) {
       throw Error("directory '%s' is not in the Nix store", userEnv);
+    }
 
     return profileDir;
   }
diff --git a/third_party/nix/src/nix/verify.cc b/third_party/nix/src/nix/verify.cc
index 3585176ed38f..6b74761ba75a 100644
--- a/third_party/nix/src/nix/verify.cc
+++ b/third_party/nix/src/nix/verify.cc
@@ -94,10 +94,10 @@ struct CmdVerify : StorePathsCommand {
         if (!noTrust) {
           bool good = false;
 
-          if (info->ultimate && !sigsNeeded)
+          if (info->ultimate && !sigsNeeded) {
             good = true;
 
-          else {
+          } else {
             StringSet sigsSeen;
             size_t actualSigsNeeded = std::max(sigsNeeded, (size_t)1);
             size_t validSigs = 0;
@@ -109,13 +109,15 @@ struct CmdVerify : StorePathsCommand {
                 }
                 sigsSeen.insert(sig);
                 if (validSigs < ValidPathInfo::maxSigs &&
-                    info->checkSignature(publicKeys, sig))
+                    info->checkSignature(publicKeys, sig)) {
                   validSigs++;
+                }
               }
             };
 
-            if (info->isContentAddressed(*store))
+            if (info->isContentAddressed(*store)) {
               validSigs = ValidPathInfo::maxSigs;
+            }
 
             doSigs(info->sigs);
 
@@ -125,8 +127,9 @@ struct CmdVerify : StorePathsCommand {
               }
               try {
                 auto info2 = store2->queryPathInfo(info->path);
-                if (info2->isContentAddressed(*store))
+                if (info2->isContentAddressed(*store)) {
                   validSigs = ValidPathInfo::maxSigs;
+                }
                 doSigs(info2->sigs);
               } catch (InvalidPath&) {
               } catch (Error& e) {
@@ -153,8 +156,9 @@ struct CmdVerify : StorePathsCommand {
       }
     };
 
-    for (auto& storePath : storePaths)
+    for (auto& storePath : storePaths) {
       pool.enqueue(std::bind(doPath, storePath));
+    }
 
     pool.process();
 
diff --git a/third_party/nix/src/nix/why-depends.cc b/third_party/nix/src/nix/why-depends.cc
index 3744f4802a61..baf27a69514a 100644
--- a/third_party/nix/src/nix/why-depends.cc
+++ b/third_party/nix/src/nix/why-depends.cc
@@ -92,14 +92,16 @@ struct CmdWhyDepends : SourceExprCommand {
 
     std::map<Path, Node> graph;
 
-    for (auto& path : closure)
+    for (auto& path : closure) {
       graph.emplace(path, Node{path, store->queryPathInfo(path)->references});
+    }
 
     // Transpose the graph.
-    for (auto& node : graph)
+    for (auto& node : graph) {
       for (auto& ref : node.second.refs) {
         graph[ref].rrefs.insert(node.first);
       }
+    }
 
     /* Run Dijkstra's shortest path algorithm to get the distance
        of every path in the closure to 'dependency'. */
@@ -146,8 +148,10 @@ struct CmdWhyDepends : SourceExprCommand {
                        node.visited ? "\e[38;5;244m" : "",
                        firstPad != "" ? "=> " : "", node.path);
 
-      if (node.path == dependencyPath && !all && packagePath != dependencyPath)
+      if (node.path == dependencyPath && !all &&
+          packagePath != dependencyPath) {
         throw BailOut();
+      }
 
       if (node.visited) {
         return;
@@ -216,10 +220,11 @@ struct CmdWhyDepends : SourceExprCommand {
 
           for (auto& hash : hashes) {
             auto pos = target.find(hash);
-            if (pos != std::string::npos)
+            if (pos != std::string::npos) {
               hits[hash].emplace_back(
                   fmt("%s -> %s\n", p2,
                       hilite(target, pos, storePathHashLen, getColour(hash))));
+            }
           }
         }
       };