From 689ef502f5b0655c9923ed77da2ae3504630f473 Mon Sep 17 00:00:00 2001
From: Vincent Ambo <tazjin@google.com>
Date: Wed, 20 May 2020 22:27:37 +0100
Subject: refactor(3p/nix): Apply clang-tidy's readability-* fixes

This applies the readability fixes listed here:

https://clang.llvm.org/extra/clang-tidy/checks/list.html
---
 third_party/nix/src/libstore/binary-cache-store.cc |   8 +-
 third_party/nix/src/libstore/build.cc              | 115 +++++++++++----------
 third_party/nix/src/libstore/crypto.cc             |   2 +-
 third_party/nix/src/libstore/crypto.hh             |   4 +-
 third_party/nix/src/libstore/derivations.cc        |  15 +--
 third_party/nix/src/libstore/download.cc           |  33 +++---
 third_party/nix/src/libstore/export-import.cc      |   2 +-
 third_party/nix/src/libstore/gc.cc                 |  20 ++--
 third_party/nix/src/libstore/globals.cc            |   9 +-
 third_party/nix/src/libstore/globals.hh            |   4 +-
 third_party/nix/src/libstore/legacy-ssh-store.cc   |  16 +--
 .../nix/src/libstore/local-binary-cache-store.cc   |   2 +-
 third_party/nix/src/libstore/local-fs-store.cc     |  10 +-
 third_party/nix/src/libstore/local-store.cc        |  71 +++++++------
 third_party/nix/src/libstore/local-store.hh        |  21 ++--
 third_party/nix/src/libstore/machines.cc           |   6 +-
 third_party/nix/src/libstore/misc.cc               |  15 +--
 third_party/nix/src/libstore/nar-accessor.cc       |   4 +-
 .../nix/src/libstore/nar-info-disk-cache.cc        |  13 +--
 third_party/nix/src/libstore/nar-info.cc           |   4 +-
 third_party/nix/src/libstore/optimise-store.cc     |  16 +--
 third_party/nix/src/libstore/parsed-derivations.cc |  61 ++++++-----
 third_party/nix/src/libstore/pathlocks.cc          |   5 +-
 third_party/nix/src/libstore/profiles.cc           |   7 +-
 third_party/nix/src/libstore/remote-fs-accessor.cc |   8 +-
 third_party/nix/src/libstore/remote-store.cc       |  60 ++++++-----
 third_party/nix/src/libstore/remote-store.hh       |   2 +-
 third_party/nix/src/libstore/sqlite.cc             |   9 +-
 third_party/nix/src/libstore/ssh.cc                |  11 +-
 third_party/nix/src/libstore/store-api.cc          |  51 ++++-----
 third_party/nix/src/libstore/store-api.hh          |   4 +-
 31 files changed, 308 insertions(+), 300 deletions(-)

(limited to 'third_party/nix/src/libstore')

diff --git a/third_party/nix/src/libstore/binary-cache-store.cc b/third_party/nix/src/libstore/binary-cache-store.cc
index bed4e717eb2f..b0d8c81d80e4 100644
--- a/third_party/nix/src/libstore/binary-cache-store.cc
+++ b/third_party/nix/src/libstore/binary-cache-store.cc
@@ -120,7 +120,7 @@ void BinaryCacheStore::addToStore(const ValidPathInfo& info,
                                   const ref<std::string>& nar,
                                   RepairFlag repair, CheckSigsFlag checkSigs,
                                   std::shared_ptr<FSAccessor> accessor) {
-  if (!repair && isValidPath(info.path)) {
+  if ((repair == 0u) && isValidPath(info.path)) {
     return;
   }
 
@@ -206,7 +206,7 @@ void BinaryCacheStore::addToStore(const ValidPathInfo& info,
                                       : compression == "bzip2"
                                             ? ".bz2"
                                             : compression == "br" ? ".br" : "");
-  if (repair || !fileExists(narInfo->url)) {
+  if ((repair != 0u) || !fileExists(narInfo->url)) {
     stats.narWrite++;
     upsertFile(narInfo->url, *narCompressed, "application/x-nix-nar");
   } else {
@@ -323,7 +323,7 @@ Path BinaryCacheStore::addTextToStore(const string& name, const string& s,
   info.path = computeStorePathForText(name, s, references);
   info.references = references;
 
-  if (repair || !isValidPath(info.path)) {
+  if ((repair != 0u) || !isValidPath(info.path)) {
     StringSink sink;
     dumpString(s, sink);
     addToStore(info, sink.s, repair, CheckSigs, nullptr);
@@ -362,7 +362,7 @@ std::shared_ptr<std::string> BinaryCacheStore::getBuildLog(const Path& path) {
     try {
       auto info = queryPathInfo(path);
       // FIXME: add a "Log" field to .narinfo
-      if (info->deriver == "") {
+      if (info->deriver.empty()) {
         return nullptr;
       }
       drvPath = info->deriver;
diff --git a/third_party/nix/src/libstore/build.cc b/third_party/nix/src/libstore/build.cc
index efc1e5a1263e..389c99f06c01 100644
--- a/third_party/nix/src/libstore/build.cc
+++ b/third_party/nix/src/libstore/build.cc
@@ -458,7 +458,7 @@ void handleDiffHook(uid_t uid, uid_t gid, Path tryA, Path tryB, Path drvPath,
                             statusToString(diffRes.first)));
       }
 
-      if (diffRes.second != "") {
+      if (!diffRes.second.empty()) {
         LOG(ERROR) << chomp(diffRes.second);
       }
     } catch (Error& error) {
@@ -512,7 +512,7 @@ UserLock::UserLock() {
 
   /* Get the members of the build-users-group. */
   struct group* gr = getgrnam(settings.buildUsersGroup.get().c_str());
-  if (!gr) {
+  if (gr == nullptr) {
     throw Error(
         format(
             "the group '%1%' specified in 'build-users-group' does not exist") %
@@ -522,7 +522,7 @@ UserLock::UserLock() {
 
   /* Copy the result of getgrnam. */
   Strings users;
-  for (char** p = gr->gr_mem; *p; ++p) {
+  for (char** p = gr->gr_mem; *p != nullptr; ++p) {
     DLOG(INFO) << "found build user " << *p;
     users.push_back(*p);
   }
@@ -538,7 +538,7 @@ UserLock::UserLock() {
     DLOG(INFO) << "trying user " << i;
 
     struct passwd* pw = getpwnam(i.c_str());
-    if (!pw) {
+    if (pw == nullptr) {
       throw Error(format("the user '%1%' in the group '%2%' does not exist") %
                   i % settings.buildUsersGroup);
     }
@@ -550,7 +550,7 @@ UserLock::UserLock() {
 
     {
       auto lockedPaths(lockedPaths_.lock());
-      if (lockedPaths->count(fnUserLock)) {
+      if (lockedPaths->count(fnUserLock) != 0u) {
         /* We already have a lock on this one. */
         continue;
       }
@@ -937,7 +937,7 @@ class DerivationGoal : public Goal {
   /* Run the builder's process. */
   void runChild();
 
-  friend int childEntry(void*);
+  friend int childEntry(void* /*arg*/);
 
   /* Check that the derivation outputs all exist and register them
      as valid. */
@@ -1149,7 +1149,7 @@ void DerivationGoal::haveDerivation() {
   PathSet invalidOutputs = checkPathValidity(false, buildMode == bmRepair);
 
   /* If they are all valid, then we're done. */
-  if (invalidOutputs.size() == 0 && buildMode == bmNormal) {
+  if (invalidOutputs.empty() && buildMode == bmNormal) {
     done(BuildResult::AlreadyValid);
     return;
   }
@@ -1297,7 +1297,7 @@ void DerivationGoal::repairClosure() {
     LOG(ERROR) << "found corrupted or missing path '" << i
                << "' in the output closure of '" << drvPath << "'";
     Path drvPath2 = outputsToDrv[i];
-    if (drvPath2 == "") {
+    if (drvPath2.empty()) {
       addWaitee(worker.makeSubstitutionGoal(i, Repair));
     } else {
       addWaitee(worker.makeDerivationGoal(drvPath2, PathSet(), bmRepair));
@@ -1676,7 +1676,7 @@ MakeError(NotDeterministic, BuildError)
         }
 
         ~LogSink() override {
-          if (currentLine != "") {
+          if (!currentLine.empty()) {
             currentLine += '\n';
             flushLine();
           }
@@ -1733,7 +1733,7 @@ MakeError(NotDeterministic, BuildError)
     }
 
     else {
-      st = dynamic_cast<NotDeterministic*>(&e)
+      st = dynamic_cast<NotDeterministic*>(&e) != nullptr
                ? BuildResult::NotDeterministic
                : statusOk(status)
                      ? BuildResult::OutputRejected
@@ -1774,17 +1774,17 @@ HookReply DerivationGoal::tryBuildHook() {
       if (string(s, 0, 2) == "# ") {
         reply = string(s, 2);
         break;
-      } else {
-        s += "\n";
-        std::cerr << s;
       }
+      s += "\n";
+      std::cerr << s;
     }
 
     DLOG(INFO) << "hook reply is " << reply;
 
     if (reply == "decline") {
       return rpDecline;
-    } else if (reply == "decline-permanently") {
+    }
+    if (reply == "decline-permanently") {
       worker.tryBuildHook = false;
       worker.hook = nullptr;
       return rpDecline;
@@ -1799,9 +1799,8 @@ HookReply DerivationGoal::tryBuildHook() {
                  << chomp(drainFD(worker.hook->fromHook.readSide.get()));
       worker.hook = nullptr;
       return rpDecline;
-    } else {
-      throw;
     }
+    throw;
   }
 
   hook = std::move(worker.hook);
@@ -1854,7 +1853,7 @@ PathSet DerivationGoal::exportReferences(PathSet storePaths) {
 
     storePath = worker.store.toStorePath(storePath);
 
-    if (!inputPaths.count(storePath)) {
+    if (inputPaths.count(storePath) == 0u) {
       throw BuildError(
           "cannot export references of path '%s' because it is not in the "
           "input closure of the derivation",
@@ -1897,7 +1896,7 @@ static void preloadNSS() {
 
     if (getaddrinfo("this.pre-initializes.the.dns.resolvers.invalid.", "http",
                     nullptr, &res) != 0) {
-      if (res) {
+      if (res != nullptr) {
         freeaddrinfo(res);
       }
     }
@@ -2167,7 +2166,7 @@ void DerivationGoal::startBuilder() {
     for (auto& i : inputPaths) {
       Path r = worker.store.toRealPath(i);
       struct stat st;
-      if (lstat(r.c_str(), &st)) {
+      if (lstat(r.c_str(), &st) != 0) {
         throw SysError(format("getting attributes of path '%1%'") % i);
       }
       if (S_ISDIR(st.st_mode)) {
@@ -2222,7 +2221,7 @@ void DerivationGoal::startBuilder() {
        corresponding to the valid outputs, and rewrite the
        contents of the new outputs to replace the dummy strings
        with the actual hashes. */
-    if (validPaths.size() > 0) {
+    if (!validPaths.empty()) {
       for (auto& i : validPaths) {
         addHashRewrite(i);
       }
@@ -2241,7 +2240,7 @@ void DerivationGoal::startBuilder() {
   }
 
   if (useChroot && settings.preBuildHook != "" &&
-      dynamic_cast<Derivation*>(drv.get())) {
+      (dynamic_cast<Derivation*>(drv.get()) != nullptr)) {
     DLOG(INFO) << "executing pre-build hook '" << settings.preBuildHook << "'";
     auto args =
         useChroot ? Strings({drvPath, chrootRootDir}) : Strings({drvPath});
@@ -2260,7 +2259,7 @@ void DerivationGoal::startBuilder() {
           throw Error(format("unknown pre-build hook command '%1%'") % line);
         }
       } else if (state == stExtraChrootDirs) {
-        if (line == "") {
+        if (line.empty()) {
           state = stBegin;
         } else {
           auto p = line.find('=');
@@ -2291,15 +2290,15 @@ void DerivationGoal::startBuilder() {
   std::string slaveName(ptsname(builderOut.readSide.get()));
 
   if (buildUser) {
-    if (chmod(slaveName.c_str(), 0600)) {
+    if (chmod(slaveName.c_str(), 0600) != 0) {
       throw SysError("changing mode of pseudoterminal slave");
     }
 
-    if (chown(slaveName.c_str(), buildUser->getUID(), 0)) {
+    if (chown(slaveName.c_str(), buildUser->getUID(), 0) != 0) {
       throw SysError("changing owner of pseudoterminal slave");
     }
   } else {
-    if (grantpt(builderOut.readSide.get())) {
+    if (grantpt(builderOut.readSide.get()) != 0) {
       throw SysError("granting access to pseudoterminal slave");
     }
   }
@@ -2311,7 +2310,7 @@ void DerivationGoal::startBuilder() {
         dirsInChroot[slaveName] = {slaveName, false};
 #endif
 
-  if (unlockpt(builderOut.readSide.get())) {
+  if (unlockpt(builderOut.readSide.get()) != 0) {
     throw SysError("unlocking pseudoterminal");
   }
 
@@ -2322,13 +2321,13 @@ void DerivationGoal::startBuilder() {
 
   // Put the pt into raw mode to prevent \n -> \r\n translation.
   struct termios term;
-  if (tcgetattr(builderOut.writeSide.get(), &term)) {
+  if (tcgetattr(builderOut.writeSide.get(), &term) != 0) {
     throw SysError("getting pseudoterminal attributes");
   }
 
   cfmakeraw(&term);
 
-  if (tcsetattr(builderOut.writeSide.get(), TCSANOW, &term)) {
+  if (tcsetattr(builderOut.writeSide.get(), TCSANOW, &term) != 0) {
     throw SysError("putting pseudoterminal into raw mode");
   }
 
@@ -2750,7 +2749,7 @@ void setupSeccomp() {
 #if HAVE_SECCOMP
   scmp_filter_ctx ctx;
 
-  if (!(ctx = seccomp_init(SCMP_ACT_ALLOW))) {
+  if ((ctx = seccomp_init(SCMP_ACT_ALLOW)) == nullptr) {
     throw SysError("unable to initialize seccomp mode 2");
   }
 
@@ -2911,7 +2910,7 @@ void DerivationGoal::runChild() {
         createDirs(chrootRootDir + "/dev/shm");
         createDirs(chrootRootDir + "/dev/pts");
         ss.push_back("/dev/full");
-        if (settings.systemFeatures.get().count("kvm") &&
+        if ((settings.systemFeatures.get().count("kvm") != 0u) &&
             pathExists("/dev/kvm")) {
           ss.push_back("/dev/kvm");
         }
@@ -2960,9 +2959,8 @@ void DerivationGoal::runChild() {
         if (stat(source.c_str(), &st) == -1) {
           if (optional && errno == ENOENT) {
             return;
-          } else {
-            throw SysError("getting attributes of path '%1%'", source);
           }
+          throw SysError("getting attributes of path '%1%'", source);
         }
         if (S_ISDIR(st.st_mode)) {
           createDirs(target);
@@ -3005,7 +3003,7 @@ void DerivationGoal::runChild() {
          if /dev/ptx/ptmx exists). */
       if (pathExists("/dev/pts/ptmx") &&
           !pathExists(chrootRootDir + "/dev/ptmx") &&
-          !dirsInChroot.count("/dev/pts")) {
+          (dirsInChroot.count("/dev/pts") == 0u)) {
         if (mount("none", (chrootRootDir + "/dev/pts").c_str(), "devpts", 0,
                   "newinstance,mode=0620") == 0) {
           createSymlink("/dev/pts/ptmx", chrootRootDir + "/dev/ptmx");
@@ -3078,8 +3076,8 @@ void DerivationGoal::runChild() {
     uname(&utsbuf);
     if (drv->platform == "i686-linux" &&
         (settings.thisSystem == "x86_64-linux" ||
-         (!strcmp(utsbuf.sysname, "Linux") &&
-          !strcmp(utsbuf.machine, "x86_64")))) {
+         ((strcmp(utsbuf.sysname, "Linux") == 0) &&
+          (strcmp(utsbuf.machine, "x86_64") == 0)))) {
       if (personality(PER_LINUX32) == -1) {
         throw SysError("cannot set i686-linux personality");
       }
@@ -3422,7 +3420,7 @@ void DerivationGoal::registerOutputs() {
           pathExists(redirected)) {
         replaceValidPath(path, redirected);
       }
-      if (buildMode == bmCheck && redirected != "") {
+      if (buildMode == bmCheck && !redirected.empty()) {
         actualPath = redirected;
       }
     }
@@ -3442,7 +3440,7 @@ void DerivationGoal::registerOutputs() {
        that means that someone else can have interfered with the
        build.  Also, the output should be owned by the build
        user. */
-    if ((!S_ISLNK(st.st_mode) && (st.st_mode & (S_IWGRP | S_IWOTH))) ||
+    if ((!S_ISLNK(st.st_mode) && ((st.st_mode & (S_IWGRP | S_IWOTH)) != 0u)) ||
         (buildUser && st.st_uid != buildUser->getUID())) {
       throw BuildError(format("suspicious ownership or permission on '%1%'; "
                               "rejecting this build output") %
@@ -3555,7 +3553,7 @@ void DerivationGoal::registerOutputs() {
         if (settings.runDiffHook || settings.keepFailed) {
           Path dst = worker.store.toRealPath(path + checkSuffix);
           deletePath(dst);
-          if (rename(actualPath.c_str(), dst.c_str())) {
+          if (rename(actualPath.c_str(), dst.c_str()) != 0) {
             throw SysError(format("renaming '%1%' to '%2%'") % actualPath %
                            dst);
           }
@@ -3568,11 +3566,10 @@ void DerivationGoal::registerOutputs() {
               format("derivation '%1%' may not be deterministic: output '%2%' "
                      "differs from '%3%'") %
               drvPath % path % dst);
-        } else {
-          throw NotDeterministic(format("derivation '%1%' may not be "
-                                        "deterministic: output '%2%' differs") %
-                                 drvPath % path);
         }
+        throw NotDeterministic(format("derivation '%1%' may not be "
+                                      "deterministic: output '%2%' differs") %
+                               drvPath % path);
       }
 
       /* Since we verified the build, it's now ultimately
@@ -3665,7 +3662,7 @@ void DerivationGoal::registerOutputs() {
       Path prev = i.second.path + checkSuffix;
       deletePath(prev);
       Path dst = i.second.path + checkSuffix;
-      if (rename(i.second.path.c_str(), dst.c_str())) {
+      if (rename(i.second.path.c_str(), dst.c_str()) != 0) {
         throw SysError(format("renaming '%1%' to '%2%'") % i.second.path % dst);
       }
     }
@@ -3791,11 +3788,11 @@ void DerivationGoal::checkOutputs(
 
         for (auto& i : used) {
           if (allowed) {
-            if (!spec.count(i)) {
+            if (spec.count(i) == 0u) {
               badPaths.insert(i);
             }
           } else {
-            if (spec.count(i)) {
+            if (spec.count(i) != 0u) {
               badPaths.insert(i);
             }
           }
@@ -3889,7 +3886,7 @@ Path DerivationGoal::openLogFile() {
   string baseName = baseNameOf(drvPath);
 
   /* Create a log file. */
-  Path dir = fmt("%s/%s/%s/", worker.store.logDir, worker.store.drvsLogDir,
+  Path dir = fmt("%s/%s/%s/", worker.store.logDir, nix::LocalStore::drvsLogDir,
                  string(baseName, 0, 2));
   createDirs(dir);
 
@@ -3927,7 +3924,7 @@ void DerivationGoal::closeLogFile() {
 }
 
 void DerivationGoal::deleteTmpDir(bool force) {
-  if (tmpDir != "") {
+  if (!tmpDir.empty()) {
     /* Don't keep temporary directories for builtins because they
        might have privileged stuff (like a copy of netrc). */
     if (settings.keepFailed && !force && !drv->isBuiltin()) {
@@ -4165,7 +4162,7 @@ void SubstitutionGoal::init() {
   worker.store.addTempRoot(storePath);
 
   /* If the path already exists we're done. */
-  if (!repair && worker.store.isValidPath(storePath)) {
+  if ((repair == 0u) && worker.store.isValidPath(storePath)) {
     amDone(ecSuccess);
     return;
   }
@@ -4186,7 +4183,7 @@ void SubstitutionGoal::init() {
 void SubstitutionGoal::tryNext() {
   trace("trying next substituter");
 
-  if (subs.size() == 0) {
+  if (subs.empty()) {
     /* None left.  Terminate this goal and let someone else deal
        with it. */
     DLOG(WARNING)
@@ -4241,7 +4238,7 @@ void SubstitutionGoal::tryNext() {
       worker.expectedNarSize, info->narSize);
 
   maintainExpectedDownload =
-      narInfo && narInfo->fileSize
+      narInfo && (narInfo->fileSize != 0u)
           ? std::make_unique<MaintainCount<uint64_t>>(
                 worker.expectedDownloadSize, narInfo->fileSize)
           : nullptr;
@@ -4250,7 +4247,8 @@ void SubstitutionGoal::tryNext() {
      signature. LocalStore::addToStore() also checks for this, but
      only after we've downloaded the path. */
   if (worker.store.requireSigs && !sub->isTrusted &&
-      !info->checkSignatures(worker.store, worker.store.getPublicKeys())) {
+      (info->checkSignatures(worker.store, worker.store.getPublicKeys()) ==
+       0u)) {
     LOG(WARNING) << "substituter '" << sub->getUri()
                  << "' does not have a valid signature for path '" << storePath
                  << "'";
@@ -4804,10 +4802,10 @@ unsigned int Worker::exitStatus() {
     mask |= 0x08;  // 104
   }
 
-  if (mask) {
+  if (mask != 0u) {
     mask |= 0x60;
   }
-  return mask ? mask : 1;
+  return mask != 0u ? mask : 1;
 }
 
 bool Worker::pathContentsGood(const Path& path) {
@@ -4839,8 +4837,11 @@ void Worker::markContentsGood(const Path& path) {
 //////////////////////////////////////////////////////////////////////
 
 static void primeCache(Store& store, const PathSet& paths) {
-  PathSet willBuild, willSubstitute, unknown;
-  unsigned long long downloadSize, narSize;
+  PathSet willBuild;
+  PathSet willSubstitute;
+  PathSet unknown;
+  unsigned long long downloadSize;
+  unsigned long long narSize;
   store.queryMissing(paths, willBuild, willSubstitute, unknown, downloadSize,
                      narSize);
 
@@ -4876,7 +4877,7 @@ void LocalStore::buildPaths(const PathSet& drvPaths, BuildMode buildMode) {
   for (auto& i : goals) {
     if (i->getExitCode() != Goal::ecSuccess) {
       auto* i2 = dynamic_cast<DerivationGoal*>(i.get());
-      if (i2) {
+      if (i2 != nullptr) {
         failed.insert(i2->getDrvPath());
       } else {
         failed.insert(dynamic_cast<SubstitutionGoal*>(i.get())->getStorePath());
@@ -4939,7 +4940,7 @@ void LocalStore::repairPath(const Path& path) {
     /* Since substituting the path didn't work, if we have a valid
        deriver, then rebuild the deriver. */
     auto deriver = queryPathInfo(path)->deriver;
-    if (deriver != "" && isValidPath(deriver)) {
+    if (!deriver.empty() && isValidPath(deriver)) {
       goals.clear();
       goals.insert(worker.makeDerivationGoal(deriver, StringSet(), bmRepair));
       worker.run(goals);
diff --git a/third_party/nix/src/libstore/crypto.cc b/third_party/nix/src/libstore/crypto.cc
index f26cabdf6dc7..2fbc30fb3161 100644
--- a/third_party/nix/src/libstore/crypto.cc
+++ b/third_party/nix/src/libstore/crypto.cc
@@ -23,7 +23,7 @@ Key::Key(const string& s) {
   name = ss.first;
   key = ss.second;
 
-  if (name == "" || key == "") {
+  if (name.empty() || key.empty()) {
     throw Error("secret key is corrupt");
   }
 
diff --git a/third_party/nix/src/libstore/crypto.hh b/third_party/nix/src/libstore/crypto.hh
index 637099231dc0..ef578db6d055 100644
--- a/third_party/nix/src/libstore/crypto.hh
+++ b/third_party/nix/src/libstore/crypto.hh
@@ -24,13 +24,13 @@ struct SecretKey : Key {
   SecretKey(const std::string& s);
 
   /* Return a detached signature of the given string. */
-  std::string signDetached(const std::string& s) const;
+  std::string signDetached(const std::string& data) const;
 
   PublicKey toPublicKey() const;
 };
 
 struct PublicKey : Key {
-  PublicKey(const std::string& data);
+  PublicKey(const std::string& s);
 
  private:
   PublicKey(const std::string& name, const std::string& key) : Key(name, key) {}
diff --git a/third_party/nix/src/libstore/derivations.cc b/third_party/nix/src/libstore/derivations.cc
index 2955056e06ea..029c14640b7a 100644
--- a/third_party/nix/src/libstore/derivations.cc
+++ b/third_party/nix/src/libstore/derivations.cc
@@ -90,7 +90,7 @@ static string parseString(std::istream& str) {
 
 static Path parsePath(std::istream& str) {
   string s = parseString(str);
-  if (s.size() == 0 || s[0] != '/') {
+  if (s.empty() || s[0] != '/') {
     throw FormatError(format("bad path '%1%' in derivation") % s);
   }
   return s;
@@ -197,7 +197,7 @@ Derivation Store::derivationFromPath(const Path& drvPath) {
 
 static void printString(string& res, const string& s) {
   res += '"';
-  for (const char* i = s.c_str(); *i; i++) {
+  for (const char* i = s.c_str(); *i != 0; i++) {
     if (*i == '\"' || *i == '\\') {
       res += "\\";
       res += *i;
@@ -303,7 +303,7 @@ bool isDerivation(const string& fileName) {
 
 bool BasicDerivation::isFixedOutput() const {
   return outputs.size() == 1 && outputs.begin()->first == "out" &&
-         outputs.begin()->second.hash != "";
+         !outputs.begin()->second.hash.empty();
 }
 
 DrvHashes drvHashes;
@@ -356,10 +356,11 @@ Hash hashDerivationModulo(Store& store, Derivation drv) {
 
 DrvPathWithOutputs parseDrvPathWithOutputs(const string& s) {
   size_t n = s.find("!");
-  return n == s.npos ? DrvPathWithOutputs(s, std::set<string>())
-                     : DrvPathWithOutputs(string(s, 0, n),
-                                          tokenizeString<std::set<string> >(
-                                              string(s, n + 1), ","));
+  return n == std::string::npos
+             ? DrvPathWithOutputs(s, std::set<string>())
+             : DrvPathWithOutputs(
+                   string(s, 0, n),
+                   tokenizeString<std::set<string> >(string(s, n + 1), ","));
 }
 
 Path makeDrvPathWithOutputs(const Path& drvPath,
diff --git a/third_party/nix/src/libstore/download.cc b/third_party/nix/src/libstore/download.cc
index eb7095ee146a..752f546a584b 100644
--- a/third_party/nix/src/libstore/download.cc
+++ b/third_party/nix/src/libstore/download.cc
@@ -39,9 +39,8 @@ std::string resolveUri(const std::string& uri) {
   if (uri.compare(0, 8, "channel:") == 0) {
     return "https://nixos.org/channels/" + std::string(uri, 8) +
            "/nixexprs.tar.xz";
-  } else {
-    return uri;
   }
+  return uri;
 }
 
 struct CurlDownloader : public Downloader {
@@ -111,13 +110,13 @@ struct CurlDownloader : public Downloader {
     }
 
     ~DownloadItem() {
-      if (req) {
+      if (req != nullptr) {
         if (active) {
           curl_multi_remove_handle(downloader.curlm, req);
         }
         curl_easy_cleanup(req);
       }
-      if (requestHeaders) {
+      if (requestHeaders != nullptr) {
         curl_slist_free_all(requestHeaders);
       }
       try {
@@ -214,13 +213,13 @@ struct CurlDownloader : public Downloader {
       return ((DownloadItem*)userp)->headerCallback(contents, size, nmemb);
     }
 
-    int progressCallback(double dltotal, double dlnow) {
+    static int progressCallback(double dltotal, double dlnow) {
       try {
         // TODO(tazjin): this had activity nonsense, clean it up
       } catch (nix::Interrupted&) {
         assert(_isInterrupted);
       }
-      return _isInterrupted;
+      return static_cast<int>(_isInterrupted);
     }
 
     static int progressCallbackWrapper(void* userp, double dltotal,
@@ -255,7 +254,7 @@ struct CurlDownloader : public Downloader {
     }
 
     void init() {
-      if (!req) {
+      if (req == nullptr) {
         req = curl_easy_init();
       }
 
@@ -314,7 +313,7 @@ struct CurlDownloader : public Downloader {
       }
 
       if (request.verifyTLS) {
-        if (settings.caFile != "") {
+        if (!settings.caFile.empty()) {
           curl_easy_setopt(req, CURLOPT_CAINFO, settings.caFile.c_str());
         }
       } else {
@@ -335,7 +334,7 @@ struct CurlDownloader : public Downloader {
                        settings.netrcFile.get().c_str());
       curl_easy_setopt(req, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
 
-      if (writtenToSink) {
+      if (writtenToSink != 0) {
         curl_easy_setopt(req, CURLOPT_RESUME_FROM_LARGE, writtenToSink);
       }
 
@@ -349,7 +348,7 @@ struct CurlDownloader : public Downloader {
 
       char* effectiveUriCStr;
       curl_easy_getinfo(req, CURLINFO_EFFECTIVE_URL, &effectiveUriCStr);
-      if (effectiveUriCStr) {
+      if (effectiveUriCStr != nullptr) {
         result.effectiveUri = effectiveUriCStr;
       }
 
@@ -461,10 +460,10 @@ struct CurlDownloader : public Downloader {
             (!this->request.dataCallback || writtenToSink == 0 ||
              (acceptRanges && encoding.empty()))) {
           int ms = request.baseRetryTimeMs *
-                   std::pow(2.0f, attempt - 1 +
+                   std::pow(2.0F, attempt - 1 +
                                       std::uniform_real_distribution<>(
                                           0.0, 0.5)(downloader.mt19937));
-          if (writtenToSink) {
+          if (writtenToSink != 0) {
             LOG(WARNING) << exc.what() << "; retrying from offset "
                          << writtenToSink << " in " << ms << "ms";
           } else {
@@ -528,7 +527,7 @@ struct CurlDownloader : public Downloader {
 
     workerThread.join();
 
-    if (curlm) {
+    if (curlm != nullptr) {
       curl_multi_cleanup(curlm);
     }
   }
@@ -567,7 +566,7 @@ struct CurlDownloader : public Downloader {
       /* Set the promises of any finished requests. */
       CURLMsg* msg;
       int left;
-      while ((msg = curl_multi_info_read(curlm, &left))) {
+      while ((msg = curl_multi_info_read(curlm, &left)) != nullptr) {
         if (msg->msg == CURLMSG_DONE) {
           auto i = items.find(msg->easy_handle);
           assert(i != items.end());
@@ -605,7 +604,7 @@ struct CurlDownloader : public Downloader {
       /* Add new curl requests from the incoming requests queue,
          except for requests that are embargoed (waiting for a
          retry timeout to expire). */
-      if (extraFDs[0].revents & CURL_WAIT_POLLIN) {
+      if ((extraFDs[0].revents & CURL_WAIT_POLLIN) != 0) {
         char buf[1024];
         auto res = read(extraFDs[0].fd, buf, sizeof(buf));
         if (res == -1 && errno != EINTR) {
@@ -863,7 +862,7 @@ CachedDownloadResult Downloader::downloadCached(
   auto url = resolveUri(request.uri);
 
   auto name = request.name;
-  if (name == "") {
+  if (name.empty()) {
     auto p = url.rfind('/');
     if (p != string::npos) {
       name = string(url, p + 1);
@@ -987,7 +986,7 @@ CachedDownloadResult Downloader::downloadCached(
     storePath = unpackedStorePath;
   }
 
-  if (expectedStorePath != "" && storePath != expectedStorePath) {
+  if (!expectedStorePath.empty() && storePath != expectedStorePath) {
     unsigned int statusCode = 102;
     Hash gotHash =
         request.unpack
diff --git a/third_party/nix/src/libstore/export-import.cc b/third_party/nix/src/libstore/export-import.cc
index de68304e3141..1974773ba135 100644
--- a/third_party/nix/src/libstore/export-import.cc
+++ b/third_party/nix/src/libstore/export-import.cc
@@ -87,7 +87,7 @@ Paths Store::importPaths(Source& source, std::shared_ptr<FSAccessor> accessor,
     info.references = readStorePaths<PathSet>(*this, source);
 
     info.deriver = readString(source);
-    if (info.deriver != "") {
+    if (!info.deriver.empty()) {
       assertStorePath(info.deriver);
     }
 
diff --git a/third_party/nix/src/libstore/gc.cc b/third_party/nix/src/libstore/gc.cc
index a0c84dc0a518..bc3393265e48 100644
--- a/third_party/nix/src/libstore/gc.cc
+++ b/third_party/nix/src/libstore/gc.cc
@@ -236,7 +236,8 @@ void LocalStore::findTempRoots(FDs& fds, Roots& tempRoots, bool censor) {
     string contents = readFile(fd->get());
 
     /* Extract the roots. */
-    string::size_type pos = 0, end;
+    string::size_type pos = 0;
+    string::size_type end;
 
     while ((end = contents.find((char)0, pos)) != string::npos) {
       Path root(contents, pos, end - pos);
@@ -542,7 +543,7 @@ void LocalStore::deletePathRecursive(GCState& state, const Path& path) {
   Path realPath = realStoreDir + "/" + baseNameOf(path);
 
   struct stat st;
-  if (lstat(realPath.c_str(), &st)) {
+  if (lstat(realPath.c_str(), &st) != 0) {
     if (errno == ENOENT) {
       return;
     }
@@ -567,7 +568,7 @@ void LocalStore::deletePathRecursive(GCState& state, const Path& path) {
         throw SysError(format("making '%1%' writable") % realPath);
       }
       Path tmp = trashDir + "/" + baseNameOf(path);
-      if (rename(realPath.c_str(), tmp.c_str())) {
+      if (rename(realPath.c_str(), tmp.c_str()) != 0) {
         throw SysError(format("unable to rename '%1%' to '%2%'") % realPath %
                        tmp);
       }
@@ -593,19 +594,19 @@ void LocalStore::deletePathRecursive(GCState& state, const Path& path) {
 
 bool LocalStore::canReachRoot(GCState& state, PathSet& visited,
                               const Path& path) {
-  if (visited.count(path)) {
+  if (visited.count(path) != 0u) {
     return false;
   }
 
-  if (state.alive.count(path)) {
+  if (state.alive.count(path) != 0u) {
     return true;
   }
 
-  if (state.dead.count(path)) {
+  if (state.dead.count(path) != 0u) {
     return false;
   }
 
-  if (state.roots.count(path)) {
+  if (state.roots.count(path) != 0u) {
     DLOG(INFO) << "cannot delete '" << path << "' because it's a root";
     state.alive.insert(path);
     return true;
@@ -713,7 +714,8 @@ void LocalStore::removeUnusedLinks(const GCState& state) {
     throw SysError(format("opening directory '%1%'") % linksDir);
   }
 
-  long long actualSize = 0, unsharedSize = 0;
+  long long actualSize = 0;
+  long long unsharedSize = 0;
 
   struct dirent* dirent;
   while (errno = 0, dirent = readdir(dir.get())) {
@@ -930,7 +932,7 @@ void LocalStore::autoGC(bool sync) {
     }
 
     struct statvfs st;
-    if (statvfs(realStoreDir.c_str(), &st)) {
+    if (statvfs(realStoreDir.c_str(), &st) != 0) {
       throw SysError("getting filesystem info about '%s'", realStoreDir);
     }
 
diff --git a/third_party/nix/src/libstore/globals.cc b/third_party/nix/src/libstore/globals.cc
index ade200f135ae..57ba8cff6434 100644
--- a/third_party/nix/src/libstore/globals.cc
+++ b/third_party/nix/src/libstore/globals.cc
@@ -46,7 +46,7 @@ Settings::Settings()
   lockCPU = getEnv("NIX_AFFINITY_HACK", "1") == "1";
 
   caFile = getEnv("NIX_SSL_CERT_FILE", getEnv("SSL_CERT_FILE", ""));
-  if (caFile == "") {
+  if (caFile.empty()) {
     for (auto& fn :
          {"/etc/ssl/certs/ca-certificates.crt",
           "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"}) {
@@ -59,7 +59,7 @@ Settings::Settings()
 
   /* Backwards compatibility. */
   auto s = getEnv("NIX_REMOTE_SYSTEMS");
-  if (s != "") {
+  if (!s.empty()) {
     Strings ss;
     for (auto& p : tokenizeString<Strings>(s, ":")) {
       ss.push_back("@" + p);
@@ -128,7 +128,8 @@ template <>
 std::string BaseSetting<SandboxMode>::to_string() {
   if (value == smEnabled) {
     return "true";
-  } else if (value == smRelaxed) {
+  }
+  if (value == smRelaxed) {
     return "relaxed";
   } else if (value == smDisabled) {
     return "false";
@@ -189,7 +190,7 @@ void initPlugins() {
       /* handle is purposefully leaked as there may be state in the
          DSO needed by the action of the plugin. */
       void* handle = dlopen(file.c_str(), RTLD_LAZY | RTLD_LOCAL);
-      if (!handle) {
+      if (handle == nullptr) {
         throw Error("could not dynamically open plugin file '%s': %s", file,
                     dlerror());
       }
diff --git a/third_party/nix/src/libstore/globals.hh b/third_party/nix/src/libstore/globals.hh
index 924e8a0165f8..8e04b0937457 100644
--- a/third_party/nix/src/libstore/globals.hh
+++ b/third_party/nix/src/libstore/globals.hh
@@ -25,9 +25,9 @@ struct MaxBuildJobsSetting : public BaseSetting<unsigned int> {
 };
 
 class Settings : public Config {
-  unsigned int getDefaultCores();
+  static unsigned int getDefaultCores();
 
-  StringSet getDefaultSystemFeatures();
+  static StringSet getDefaultSystemFeatures();
 
  public:
   Settings();
diff --git a/third_party/nix/src/libstore/legacy-ssh-store.cc b/third_party/nix/src/libstore/legacy-ssh-store.cc
index 7723581136d8..9a84e0295657 100644
--- a/third_party/nix/src/libstore/legacy-ssh-store.cc
+++ b/third_party/nix/src/libstore/legacy-ssh-store.cc
@@ -58,7 +58,7 @@ struct LegacySSHStore : public Store {
     auto conn = make_ref<Connection>();
     conn->sshConn = master.startCommand(
         fmt("%s --serve --write", remoteProgram) +
-        (remoteStore.get() == ""
+        (remoteStore.get().empty()
              ? ""
              : " --store " + shellEscape(remoteStore.get())));
     conn->to = FdSink(conn->sshConn->in.get());
@@ -120,7 +120,7 @@ struct LegacySSHStore : public Store {
       }
 
       auto s = readString(conn->from);
-      assert(s == "");
+      assert(s.empty());
 
       callback(std::move(info));
     } catch (...) {
@@ -139,8 +139,8 @@ struct LegacySSHStore : public Store {
     if (GET_PROTOCOL_MINOR(conn->remoteVersion) >= 5) {
       conn->to << cmdAddToStoreNar << info.path << info.deriver
                << info.narHash.to_string(Base16, false) << info.references
-               << info.registrationTime << info.narSize << info.ultimate
-               << info.sigs << info.ca;
+               << info.registrationTime << info.narSize
+               << static_cast<uint64_t>(info.ultimate) << info.sigs << info.ca;
       try {
         copyNAR(source, conn->to);
       } catch (...) {
@@ -201,7 +201,8 @@ struct LegacySSHStore : public Store {
       conn->to << settings.maxLogSize;
     }
     if (GET_PROTOCOL_MINOR(conn->remoteVersion) >= 3) {
-      conn->to << settings.buildRepeat << settings.enforceDeterminism;
+      conn->to << settings.buildRepeat
+               << static_cast<uint64_t>(settings.enforceDeterminism);
     }
 
     conn->to.flush();
@@ -231,7 +232,8 @@ struct LegacySSHStore : public Store {
 
     auto conn(connections->get());
 
-    conn->to << cmdQueryClosure << includeOutputs << paths;
+    conn->to << cmdQueryClosure << static_cast<uint64_t>(includeOutputs)
+             << paths;
     conn->to.flush();
 
     auto res = readStorePaths<PathSet>(*this, conn->from);
@@ -243,7 +245,7 @@ struct LegacySSHStore : public Store {
                                                     NoSubstitute) override {
     auto conn(connections->get());
 
-    conn->to << cmdQueryValidPaths << false  // lock
+    conn->to << cmdQueryValidPaths << 0u  // lock
              << maybeSubstitute << paths;
     conn->to.flush();
 
diff --git a/third_party/nix/src/libstore/local-binary-cache-store.cc b/third_party/nix/src/libstore/local-binary-cache-store.cc
index 58ce7c091147..00bb21eb24fe 100644
--- a/third_party/nix/src/libstore/local-binary-cache-store.cc
+++ b/third_party/nix/src/libstore/local-binary-cache-store.cc
@@ -59,7 +59,7 @@ static void atomicWrite(const Path& path, const std::string& s) {
   Path tmp = path + ".tmp." + std::to_string(getpid());
   AutoDelete del(tmp, false);
   writeFile(tmp, s);
-  if (rename(tmp.c_str(), path.c_str())) {
+  if (rename(tmp.c_str(), path.c_str()) != 0) {
     throw SysError(format("renaming '%1%' to '%2%'") % tmp % path);
   }
   del.cancel();
diff --git a/third_party/nix/src/libstore/local-fs-store.cc b/third_party/nix/src/libstore/local-fs-store.cc
index f3ac5b3663ff..9a5ea153869a 100644
--- a/third_party/nix/src/libstore/local-fs-store.cc
+++ b/third_party/nix/src/libstore/local-fs-store.cc
@@ -27,7 +27,7 @@ struct LocalStoreAccessor : public FSAccessor {
     auto realPath = toRealPath(path);
 
     struct stat st;
-    if (lstat(realPath.c_str(), &st)) {
+    if (lstat(realPath.c_str(), &st) != 0) {
       if (errno == ENOENT || errno == ENOTDIR) {
         return {Type::tMissing, 0, false};
       }
@@ -42,7 +42,7 @@ struct LocalStoreAccessor : public FSAccessor {
                 ? Type::tRegular
                 : S_ISLNK(st.st_mode) ? Type::tSymlink : Type::tDirectory,
             S_ISREG(st.st_mode) ? (uint64_t)st.st_size : 0,
-            S_ISREG(st.st_mode) && st.st_mode & S_IXUSR};
+            S_ISREG(st.st_mode) && ((st.st_mode & S_IXUSR) != 0u)};
   }
 
   StringSet readDirectory(const Path& path) override {
@@ -92,7 +92,7 @@ std::shared_ptr<std::string> LocalFSStore::getBuildLog(const Path& path_) {
     } catch (InvalidPath&) {
       return nullptr;
     }
-    if (path == "") {
+    if (path.empty()) {
       return nullptr;
     }
   }
@@ -107,8 +107,8 @@ std::shared_ptr<std::string> LocalFSStore::getBuildLog(const Path& path_) {
 
     if (pathExists(logPath)) {
       return std::make_shared<std::string>(readFile(logPath));
-
-    } else if (pathExists(logBz2Path)) {
+    }
+    if (pathExists(logBz2Path)) {
       try {
         return decompress("bzip2", readFile(logBz2Path));
       } catch (Error&) {
diff --git a/third_party/nix/src/libstore/local-store.cc b/third_party/nix/src/libstore/local-store.cc
index 1fa5cb904181..1d162ad6be10 100644
--- a/third_party/nix/src/libstore/local-store.cc
+++ b/third_party/nix/src/libstore/local-store.cc
@@ -86,12 +86,12 @@ LocalStore::LocalStore(const Params& params)
     mode_t perm = 01775;
 
     struct group* gr = getgrnam(settings.buildUsersGroup.get().c_str());
-    if (!gr) {
+    if (gr == nullptr) {
       LOG(ERROR) << "warning: the group '" << settings.buildUsersGroup
                  << "' specified in 'build-users-group' does not exist";
     } else {
       struct stat st;
-      if (stat(realStoreDir.c_str(), &st)) {
+      if (stat(realStoreDir.c_str(), &st) != 0) {
         throw SysError(format("getting attributes of path '%1%'") %
                        realStoreDir);
       }
@@ -115,7 +115,7 @@ LocalStore::LocalStore(const Params& params)
     Path path = realStoreDir;
     struct stat st;
     while (path != "/") {
-      if (lstat(path.c_str(), &st)) {
+      if (lstat(path.c_str(), &st) != 0) {
         throw SysError(format("getting status of '%1%'") % path);
       }
       if (S_ISLNK(st.st_mode)) {
@@ -153,7 +153,7 @@ LocalStore::LocalStore(const Params& params)
   /* Acquire the big fat lock in shared mode to make sure that no
      schema upgrade is in progress. */
   Path globalLockPath = dbDir + "/big-lock";
-  globalLock = openLockFile(globalLockPath.c_str(), true);
+  globalLock = openLockFile(globalLockPath, true);
 
   if (!lockFile(globalLock.get(), ltRead, false)) {
     LOG(INFO) << "waiting for the big Nix store lock...";
@@ -168,8 +168,8 @@ LocalStore::LocalStore(const Params& params)
         format(
             "current Nix store schema is version %1%, but I only support %2%") %
         curSchema % nixSchemaVersion);
-
-  } else if (curSchema == 0) { /* new store */
+  }
+  if (curSchema == 0) { /* new store */
     curSchema = nixSchemaVersion;
     openDB(*state, true);
     writeFile(schemaPath, (format("%1%") % nixSchemaVersion).str());
@@ -311,7 +311,7 @@ int LocalStore::getSchema() {
 }
 
 void LocalStore::openDB(State& state, bool create) {
-  if (access(dbDir.c_str(), R_OK | W_OK)) {
+  if (access(dbDir.c_str(), R_OK | W_OK) != 0) {
     throw SysError(format("Nix database directory '%1%' is not writable") %
                    dbDir);
   }
@@ -399,7 +399,7 @@ void LocalStore::makeStoreWritable() {
     throw SysError("getting info about the Nix store mount point");
   }
 
-  if (stat.f_flag & ST_RDONLY) {
+  if ((stat.f_flag & ST_RDONLY) != 0u) {
     if (unshare(CLONE_NEWNS) == -1) {
       throw SysError("setting up a private mount namespace");
     }
@@ -421,7 +421,8 @@ static void canonicaliseTimestampAndPermissions(const Path& path,
     mode_t mode = st.st_mode & ~S_IFMT;
 
     if (mode != 0444 && mode != 0555) {
-      mode = (st.st_mode & S_IFMT) | 0444 | (st.st_mode & S_IXUSR ? 0111 : 0);
+      mode = (st.st_mode & S_IFMT) | 0444 |
+             ((st.st_mode & S_IXUSR) != 0u ? 0111 : 0);
       if (chmod(path.c_str(), mode) == -1) {
         throw SysError(format("changing mode of '%1%' to %2$o") % path % mode);
       }
@@ -449,7 +450,7 @@ static void canonicaliseTimestampAndPermissions(const Path& path,
 
 void canonicaliseTimestampAndPermissions(const Path& path) {
   struct stat st;
-  if (lstat(path.c_str(), &st)) {
+  if (lstat(path.c_str(), &st) != 0) {
     throw SysError(format("getting attributes of path '%1%'") % path);
   }
   canonicaliseTimestampAndPermissions(path, st);
@@ -470,7 +471,7 @@ static void canonicalisePathMetaData_(const Path& path, uid_t fromUid,
 #endif
 
   struct stat st;
-  if (lstat(path.c_str(), &st)) {
+  if (lstat(path.c_str(), &st) != 0) {
     throw SysError(format("getting attributes of path '%1%'") % path);
   }
 
@@ -564,7 +565,7 @@ void canonicalisePathMetaData(const Path& path, uid_t fromUid,
   /* On platforms that don't have lchown(), the top-level path can't
      be a symlink, since we can't change its ownership. */
   struct stat st;
-  if (lstat(path.c_str(), &st)) {
+  if (lstat(path.c_str(), &st) != 0) {
     throw SysError(format("getting attributes of path '%1%'") % path);
   }
 
@@ -632,7 +633,7 @@ void LocalStore::checkDerivationOutputs(const Path& drvPath,
 
 uint64_t LocalStore::addValidPath(State& state, const ValidPathInfo& info,
                                   bool checkOutputs) {
-  if (info.ca != "" && !info.isContentAddressed(*this)) {
+  if (!info.ca.empty() && !info.isContentAddressed(*this)) {
     throw Error(
         "cannot add path '%s' to the Nix store because it claims to be "
         "content-addressed but isn't",
@@ -642,7 +643,7 @@ uint64_t LocalStore::addValidPath(State& state, const ValidPathInfo& info,
   state.stmtRegisterValidPath
       .use()(info.path)(info.narHash.to_string(Base16))(
           info.registrationTime == 0 ? time(nullptr) : info.registrationTime)(
-          info.deriver, info.deriver != "")(info.narSize, info.narSize != 0)(
+          info.deriver, !info.deriver.empty())(info.narSize, info.narSize != 0)(
           info.ultimate ? 1 : 0, info.ultimate)(
           concatStringsSep(" ", info.sigs), !info.sigs.empty())(
           info.ca, !info.ca.empty())
@@ -709,7 +710,7 @@ void LocalStore::queryPathInfoUncached(
       info->registrationTime = useQueryPathInfo.getInt(2);
 
       auto s = (const char*)sqlite3_column_text(state->stmtQueryPathInfo, 3);
-      if (s) {
+      if (s != nullptr) {
         info->deriver = s;
       }
 
@@ -719,12 +720,12 @@ void LocalStore::queryPathInfoUncached(
       info->ultimate = useQueryPathInfo.getInt(5) == 1;
 
       s = (const char*)sqlite3_column_text(state->stmtQueryPathInfo, 6);
-      if (s) {
+      if (s != nullptr) {
         info->sigs = tokenizeString<StringSet>(s, " ");
       }
 
       s = (const char*)sqlite3_column_text(state->stmtQueryPathInfo, 7);
-      if (s) {
+      if (s != nullptr) {
         info->ca = s;
       }
 
@@ -880,8 +881,10 @@ Path LocalStore::queryPathFromHashPart(const string& hashPart) {
 
     const char* s =
         (const char*)sqlite3_column_text(state->stmtQueryPathFromHashPart, 0);
-    return s && prefix.compare(0, prefix.size(), s, prefix.size()) == 0 ? s
-                                                                        : "";
+    return (s != nullptr) &&
+                   prefix.compare(0, prefix.size(), s, prefix.size()) == 0
+               ? s
+               : "";
   });
 }
 
@@ -908,7 +911,7 @@ PathSet LocalStore::querySubstitutablePaths(const PathSet& paths) {
 
     PathSet remaining2;
     for (auto& path : remaining) {
-      if (valid.count(path)) {
+      if (valid.count(path) != 0u) {
         res.insert(path);
       } else {
         remaining2.insert(path);
@@ -931,7 +934,7 @@ void LocalStore::querySubstitutablePathInfos(const PathSet& paths,
       continue;
     }
     for (auto& path : paths) {
-      if (infos.count(path)) {
+      if (infos.count(path) != 0u) {
         continue;
       }
       DLOG(INFO) << "checking substituter '" << sub->getUri() << "' for path '"
@@ -1049,15 +1052,15 @@ void LocalStore::addToStore(const ValidPathInfo& info, Source& source,
     throw Error("cannot add path '%s' because it lacks a hash", info.path);
   }
 
-  if (requireSigs && checkSigs &&
-      !info.checkSignatures(*this, getPublicKeys())) {
+  if (requireSigs && (checkSigs != 0u) &&
+      (info.checkSignatures(*this, getPublicKeys()) == 0u)) {
     throw Error("cannot add path '%s' because it lacks a valid signature",
                 info.path);
   }
 
   addTempRoot(info.path);
 
-  if (repair || !isValidPath(info.path)) {
+  if ((repair != 0u) || !isValidPath(info.path)) {
     PathLocks outputLock;
 
     Path realPath = realStoreDir + "/" + baseNameOf(info.path);
@@ -1065,11 +1068,11 @@ void LocalStore::addToStore(const ValidPathInfo& info, Source& source,
     /* Lock the output path.  But don't lock if we're being called
        from a build hook (whose parent process already acquired a
        lock on this path). */
-    if (!locksHeld.count(info.path)) {
+    if (locksHeld.count(info.path) == 0u) {
       outputLock.lockPaths({realPath});
     }
 
-    if (repair || !isValidPath(info.path)) {
+    if ((repair != 0u) || !isValidPath(info.path)) {
       deletePath(realPath);
 
       /* While restoring the path from the NAR, compute the hash
@@ -1121,7 +1124,7 @@ Path LocalStore::addToStoreFromDump(const string& dump, const string& name,
 
   addTempRoot(dstPath);
 
-  if (repair || !isValidPath(dstPath)) {
+  if ((repair != 0u) || !isValidPath(dstPath)) {
     /* The first check above is an optimisation to prevent
        unnecessary lock acquisition. */
 
@@ -1129,7 +1132,7 @@ Path LocalStore::addToStoreFromDump(const string& dump, const string& name,
 
     PathLocks outputLock({realPath});
 
-    if (repair || !isValidPath(dstPath)) {
+    if ((repair != 0u) || !isValidPath(dstPath)) {
       deletePath(realPath);
 
       autoGC();
@@ -1196,12 +1199,12 @@ Path LocalStore::addTextToStore(const string& name, const string& s,
 
   addTempRoot(dstPath);
 
-  if (repair || !isValidPath(dstPath)) {
+  if ((repair != 0u) || !isValidPath(dstPath)) {
     Path realPath = realStoreDir + "/" + baseNameOf(dstPath);
 
     PathLocks outputLock({realPath});
 
-    if (repair || !isValidPath(dstPath)) {
+    if ((repair != 0u) || !isValidPath(dstPath)) {
       deletePath(realPath);
 
       autoGC();
@@ -1286,7 +1289,9 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair) {
   /* Check whether all valid paths actually exist. */
   LOG(INFO) << "checking path existence...";
 
-  PathSet validPaths2 = queryAllValidPaths(), validPaths, done;
+  PathSet validPaths2 = queryAllValidPaths();
+  PathSet validPaths;
+  PathSet done;
 
   fdGCLock = -1;
 
@@ -1313,7 +1318,7 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair) {
           LOG(ERROR) << "path '" << i << "' was modified! expected hash '"
                      << info->narHash.to_string() << "', got '"
                      << current.first.to_string() << "'";
-          if (repair) {
+          if (repair != 0u) {
             repairPath(i);
           } else {
             errors = true;
@@ -1398,7 +1403,7 @@ void LocalStore::verifyPath(const Path& path, const PathSet& store,
     } else {
       LOG(ERROR) << "path '" << path
                  << "' disappeared, but it still has valid referrers!";
-      if (repair) {
+      if (repair != 0u) {
         try {
           repairPath(path);
         } catch (Error& e) {
diff --git a/third_party/nix/src/libstore/local-store.hh b/third_party/nix/src/libstore/local-store.hh
index 47fa74a97be7..1a58df81613b 100644
--- a/third_party/nix/src/libstore/local-store.hh
+++ b/third_party/nix/src/libstore/local-store.hh
@@ -217,7 +217,7 @@ class LocalStore : public LocalFSStore {
 
   void makeStoreWritable();
 
-  uint64_t queryValidPathId(State& state, const Path& path);
+  static uint64_t queryValidPathId(State& state, const Path& path);
 
   uint64_t addValidPath(State& state, const ValidPathInfo& info,
                         bool checkOutputs = true);
@@ -230,7 +230,7 @@ class LocalStore : public LocalFSStore {
   void verifyPath(const Path& path, const PathSet& store, PathSet& done,
                   PathSet& validPaths, RepairFlag repair, bool& errors);
 
-  void updatePathInfo(State& state, const ValidPathInfo& info);
+  static void updatePathInfo(State& state, const ValidPathInfo& info);
 
   void upgradeStore6();
   void upgradeStore7();
@@ -239,7 +239,7 @@ class LocalStore : public LocalFSStore {
 
   struct GCState;
 
-  void deleteGarbage(GCState& state, const Path& path);
+  static void deleteGarbage(GCState& state, const Path& path);
 
   void tryToDelete(GCState& state, const Path& path);
 
@@ -247,8 +247,8 @@ class LocalStore : public LocalFSStore {
 
   void deletePathRecursive(GCState& state, const Path& path);
 
-  bool isActiveTempFile(const GCState& state, const Path& path,
-                        const string& suffix);
+  static bool isActiveTempFile(const GCState& state, const Path& path,
+                               const string& suffix);
 
   AutoCloseFD openGCLock(LockType lockType);
 
@@ -267,18 +267,19 @@ class LocalStore : public LocalFSStore {
   typedef std::unordered_set<ino_t> InodeHash;
 
   InodeHash loadInodeHash();
-  Strings readDirectoryIgnoringInodes(const Path& path,
-                                      const InodeHash& inodeHash);
+  static Strings readDirectoryIgnoringInodes(const Path& path,
+                                             const InodeHash& inodeHash);
   void optimisePath_(OptimiseStats& stats, const Path& path,
                      InodeHash& inodeHash);
 
   // Internal versions that are not wrapped in retry_sqlite.
-  bool isValidPath_(State& state, const Path& path);
-  void queryReferrers(State& state, const Path& path, PathSet& referrers);
+  static bool isValidPath_(State& state, const Path& path);
+  static void queryReferrers(State& state, const Path& path,
+                             PathSet& referrers);
 
   /* Add signatures to a ValidPathInfo using the secret keys
      specified by the ‘secret-key-files’ option. */
-  void signPathInfo(ValidPathInfo& info);
+  static void signPathInfo(ValidPathInfo& info);
 
   Path getRealStoreDir() override { return realStoreDir; }
 
diff --git a/third_party/nix/src/libstore/machines.cc b/third_party/nix/src/libstore/machines.cc
index 480d533e6099..1b8bc4cf75a5 100644
--- a/third_party/nix/src/libstore/machines.cc
+++ b/third_party/nix/src/libstore/machines.cc
@@ -35,8 +35,8 @@ Machine::Machine(decltype(storeUri) storeUri, decltype(systemTypes) systemTypes,
 bool Machine::allSupported(const std::set<string>& features) const {
   return std::all_of(features.begin(), features.end(),
                      [&](const string& feature) {
-                       return supportedFeatures.count(feature) ||
-                              mandatoryFeatures.count(feature);
+                       return (supportedFeatures.count(feature) != 0u) ||
+                              (mandatoryFeatures.count(feature) != 0u);
                      });
 }
 
@@ -74,7 +74,7 @@ void parseMachines(const std::string& s, Machines& machines) {
     }
 
     auto isSet = [&](size_t n) {
-      return tokens.size() > n && tokens[n] != "" && tokens[n] != "-";
+      return tokens.size() > n && !tokens[n].empty() && tokens[n] != "-";
     };
 
     machines.emplace_back(
diff --git a/third_party/nix/src/libstore/misc.cc b/third_party/nix/src/libstore/misc.cc
index 23abaecba050..076c691b004c 100644
--- a/third_party/nix/src/libstore/misc.cc
+++ b/third_party/nix/src/libstore/misc.cc
@@ -30,7 +30,7 @@ void Store::computeFSClosure(const PathSet& startPaths, PathSet& paths_,
       if (state->exc) {
         return;
       }
-      if (state->paths.count(path)) {
+      if (state->paths.count(path) != 0u) {
         return;
       }
       state->paths.insert(path);
@@ -90,7 +90,7 @@ void Store::computeFSClosure(const PathSet& startPaths, PathSet& paths_,
             {
               auto state(state_.lock());
               assert(state->pending);
-              if (!--state->pending) {
+              if (--state->pending == 0u) {
                 done.notify_one();
               }
             }
@@ -101,7 +101,7 @@ void Store::computeFSClosure(const PathSet& startPaths, PathSet& paths_,
               state->exc = std::current_exception();
             }
             assert(state->pending);
-            if (!--state->pending) {
+            if (--state->pending == 0u) {
               done.notify_one();
             }
           };
@@ -114,7 +114,7 @@ void Store::computeFSClosure(const PathSet& startPaths, PathSet& paths_,
 
   {
     auto state(state_.lock());
-    while (state->pending) {
+    while (state->pending != 0u) {
       state.wait(done);
     }
     if (state->exc) {
@@ -192,7 +192,7 @@ void Store::queryMissing(const PathSet& targets, PathSet& willBuild_,
         assert(drvState->left);
         drvState->left--;
         drvState->outPaths.insert(outPath);
-        if (!drvState->left) {
+        if (drvState->left == 0u) {
           for (auto& path : drvState->outPaths) {
             pool.enqueue(std::bind(doPath, path));
           }
@@ -204,7 +204,7 @@ void Store::queryMissing(const PathSet& targets, PathSet& willBuild_,
   doPath = [&](const Path& path) {
     {
       auto state(state_.lock());
-      if (state->done.count(path)) {
+      if (state->done.count(path) != 0u) {
         return;
       }
       state->done.insert(path);
@@ -282,7 +282,8 @@ void Store::queryMissing(const PathSet& targets, PathSet& willBuild_,
 
 Paths Store::topoSortPaths(const PathSet& paths) {
   Paths sorted;
-  PathSet visited, parents;
+  PathSet visited;
+  PathSet parents;
 
   std::function<void(const Path& path, const Path* parent)> dfsVisit;
 
diff --git a/third_party/nix/src/libstore/nar-accessor.cc b/third_party/nix/src/libstore/nar-accessor.cc
index ac286374b8bd..3a8d6b884104 100644
--- a/third_party/nix/src/libstore/nar-accessor.cc
+++ b/third_party/nix/src/libstore/nar-accessor.cc
@@ -132,7 +132,7 @@ struct NarAccessor : public FSAccessor {
   }
 
   NarMember* find(const Path& path) {
-    Path canon = path == "" ? "" : canonPath(path);
+    Path canon = path.empty() ? "" : canonPath(path);
     NarMember* current = &root;
     auto end = path.end();
     for (auto it = path.begin(); it != end;) {
@@ -238,7 +238,7 @@ void listNar(JSONPlaceholder& res, ref<FSAccessor> accessor, const Path& path,
       if (st.isExecutable) {
         obj.attr("executable", true);
       }
-      if (st.narOffset) {
+      if (st.narOffset != 0u) {
         obj.attr("narOffset", st.narOffset);
       }
       break;
diff --git a/third_party/nix/src/libstore/nar-info-disk-cache.cc b/third_party/nix/src/libstore/nar-info-disk-cache.cc
index 7ef178ab4388..19ef2c9d7461 100644
--- a/third_party/nix/src/libstore/nar-info-disk-cache.cc
+++ b/third_party/nix/src/libstore/nar-info-disk-cache.cc
@@ -142,7 +142,7 @@ class NarInfoDiskCacheImpl : public NarInfoDiskCache {
     });
   }
 
-  Cache& getCache(State& state, const std::string& uri) {
+  static Cache& getCache(State& state, const std::string& uri) {
     auto i = state.caches.find(uri);
     if (i == state.caches.end()) {
       abort();
@@ -158,7 +158,8 @@ class NarInfoDiskCacheImpl : public NarInfoDiskCache {
       // FIXME: race
 
       state->insertCache
-          .use()(uri)(time(nullptr))(storeDir)(wantMassQuery)(priority)
+          .use()(uri)(time(nullptr))(storeDir)(
+              static_cast<int64_t>(wantMassQuery))(priority)
           .exec();
       assert(sqlite3_changes(state->db) == 1);
       state->caches[uri] = Cache{(int)sqlite3_last_insert_rowid(state->db),
@@ -209,7 +210,7 @@ class NarInfoDiskCacheImpl : public NarInfoDiskCache {
             return {oUnknown, nullptr};
           }
 
-          if (!queryNAR.getInt(0)) {
+          if (queryNAR.getInt(0) == 0) {
             return {oInvalid, nullptr};
           }
 
@@ -262,10 +263,10 @@ class NarInfoDiskCacheImpl : public NarInfoDiskCache {
                 narInfo && narInfo->fileHash)(
                 narInfo ? narInfo->fileSize : 0,
                 narInfo != nullptr &&
-                    narInfo->fileSize)(info->narHash.to_string())(
+                    (narInfo->fileSize != 0u))(info->narHash.to_string())(
                 info->narSize)(concatStringsSep(" ", info->shortRefs()))(
-                info->deriver != "" ? baseNameOf(info->deriver) : "",
-                info->deriver != "")(concatStringsSep(" ", info->sigs))(
+                !info->deriver.empty() ? baseNameOf(info->deriver) : "",
+                !info->deriver.empty())(concatStringsSep(" ", info->sigs))(
                 info->ca)(time(nullptr))
             .exec();
 
diff --git a/third_party/nix/src/libstore/nar-info.cc b/third_party/nix/src/libstore/nar-info.cc
index fee470fc7df6..6190840ea61c 100644
--- a/third_party/nix/src/libstore/nar-info.cc
+++ b/third_party/nix/src/libstore/nar-info.cc
@@ -90,7 +90,7 @@ NarInfo::NarInfo(const Store& store, const std::string& s,
     pos = eol + 1;
   }
 
-  if (compression == "") {
+  if (compression.empty()) {
     compression = "bzip2";
   }
 
@@ -103,7 +103,7 @@ std::string NarInfo::to_string() const {
   std::string res;
   res += "StorePath: " + path + "\n";
   res += "URL: " + url + "\n";
-  assert(compression != "");
+  assert(!compression.empty());
   res += "Compression: " + compression + "\n";
   assert(fileHash.type == htSHA256);
   res += "FileHash: " + fileHash.to_string(Base32) + "\n";
diff --git a/third_party/nix/src/libstore/optimise-store.cc b/third_party/nix/src/libstore/optimise-store.cc
index 9eaf4cdc3c9e..d7cf2bb74449 100644
--- a/third_party/nix/src/libstore/optimise-store.cc
+++ b/third_party/nix/src/libstore/optimise-store.cc
@@ -18,7 +18,7 @@ namespace nix {
 
 static void makeWritable(const Path& path) {
   struct stat st;
-  if (lstat(path.c_str(), &st)) {
+  if (lstat(path.c_str(), &st) != 0) {
     throw SysError(format("getting attributes of path '%1%'") % path);
   }
   if (chmod(path.c_str(), st.st_mode | S_IWUSR) == -1) {
@@ -32,7 +32,7 @@ struct MakeReadOnly {
   ~MakeReadOnly() {
     try {
       /* This will make the path read-only. */
-      if (path != "") {
+      if (!path.empty()) {
         canonicaliseTimestampAndPermissions(path);
       }
     } catch (...) {
@@ -78,7 +78,7 @@ Strings LocalStore::readDirectoryIgnoringInodes(const Path& path,
   while (errno = 0, dirent = readdir(dir.get())) { /* sic */
     checkInterrupt();
 
-    if (inodeHash.count(dirent->d_ino)) {
+    if (inodeHash.count(dirent->d_ino) != 0u) {
       DLOG(WARNING) << dirent->d_name << " is already linked";
       continue;
     }
@@ -101,7 +101,7 @@ void LocalStore::optimisePath_(OptimiseStats& stats, const Path& path,
   checkInterrupt();
 
   struct stat st;
-  if (lstat(path.c_str(), &st)) {
+  if (lstat(path.c_str(), &st) != 0) {
     throw SysError(format("getting attributes of path '%1%'") % path);
   }
 
@@ -137,13 +137,13 @@ void LocalStore::optimisePath_(OptimiseStats& stats, const Path& path,
      modified, in particular when running programs as root under
      NixOS (example: $fontconfig/var/cache being modified).  Skip
      those files.  FIXME: check the modification time. */
-  if (S_ISREG(st.st_mode) && (st.st_mode & S_IWUSR)) {
+  if (S_ISREG(st.st_mode) && ((st.st_mode & S_IWUSR) != 0u)) {
     LOG(WARNING) << "skipping suspicious writable file '" << path << "'";
     return;
   }
 
   /* This can still happen on top-level files. */
-  if (st.st_nlink > 1 && inodeHash.count(st.st_ino)) {
+  if (st.st_nlink > 1 && (inodeHash.count(st.st_ino) != 0u)) {
     DLOG(INFO) << path << " is already linked, with " << (st.st_nlink - 2)
                << " other file(s)";
     return;
@@ -196,7 +196,7 @@ retry:
   /* Yes!  We've seen a file with the same contents.  Replace the
      current file with a hard link to that file. */
   struct stat stLink;
-  if (lstat(linkPath.c_str(), &stLink)) {
+  if (lstat(linkPath.c_str(), &stLink) != 0) {
     throw SysError(format("getting attributes of path '%1%'") % linkPath);
   }
 
@@ -234,7 +234,7 @@ retry:
       /* Too many links to the same file (>= 32000 on most file
          systems).  This is likely to happen with empty files.
          Just shrug and ignore. */
-      if (st.st_size) {
+      if (st.st_size != 0) {
         LOG(WARNING) << linkPath << " has maximum number of links";
       }
       return;
diff --git a/third_party/nix/src/libstore/parsed-derivations.cc b/third_party/nix/src/libstore/parsed-derivations.cc
index ec158e0ab1a0..1186203249de 100644
--- a/third_party/nix/src/libstore/parsed-derivations.cc
+++ b/third_party/nix/src/libstore/parsed-derivations.cc
@@ -22,20 +22,19 @@ std::optional<std::string> ParsedDerivation::getStringAttr(
     auto i = structuredAttrs->find(name);
     if (i == structuredAttrs->end()) {
       return {};
-    } else {
-      if (!i->is_string()) {
-        throw Error("attribute '%s' of derivation '%s' must be a string", name,
-                    drvPath);
-      }
-      return i->get<std::string>();
     }
+    if (!i->is_string()) {
+      throw Error("attribute '%s' of derivation '%s' must be a string", name,
+                  drvPath);
+    }
+    return i->get<std::string>();
+
   } else {
     auto i = drv.env.find(name);
     if (i == drv.env.end()) {
       return {};
-    } else {
-      return i->second;
     }
+    return i->second;
   }
 }
 
@@ -44,20 +43,19 @@ bool ParsedDerivation::getBoolAttr(const std::string& name, bool def) const {
     auto i = structuredAttrs->find(name);
     if (i == structuredAttrs->end()) {
       return def;
-    } else {
-      if (!i->is_boolean()) {
-        throw Error("attribute '%s' of derivation '%s' must be a Boolean", name,
-                    drvPath);
-      }
-      return i->get<bool>();
     }
+    if (!i->is_boolean()) {
+      throw Error("attribute '%s' of derivation '%s' must be a Boolean", name,
+                  drvPath);
+    }
+    return i->get<bool>();
+
   } else {
     auto i = drv.env.find(name);
     if (i == drv.env.end()) {
       return def;
-    } else {
-      return i->second == "1";
     }
+    return i->second == "1";
   }
 }
 
@@ -67,30 +65,28 @@ std::optional<Strings> ParsedDerivation::getStringsAttr(
     auto i = structuredAttrs->find(name);
     if (i == structuredAttrs->end()) {
       return {};
-    } else {
-      if (!i->is_array()) {
+    }
+    if (!i->is_array()) {
+      throw Error("attribute '%s' of derivation '%s' must be a list of strings",
+                  name, drvPath);
+    }
+    Strings res;
+    for (const auto& j : *i) {
+      if (!j.is_string()) {
         throw Error(
             "attribute '%s' of derivation '%s' must be a list of strings", name,
             drvPath);
       }
-      Strings res;
-      for (const auto& j : *i) {
-        if (!j.is_string()) {
-          throw Error(
-              "attribute '%s' of derivation '%s' must be a list of strings",
-              name, drvPath);
-        }
-        res.push_back(j.get<std::string>());
-      }
-      return res;
+      res.push_back(j.get<std::string>());
     }
+    return res;
+
   } else {
     auto i = drv.env.find(name);
     if (i == drv.env.end()) {
       return {};
-    } else {
-      return tokenizeString<Strings>(i->second);
     }
+    return tokenizeString<Strings>(i->second);
   }
 }
 
@@ -104,12 +100,13 @@ StringSet ParsedDerivation::getRequiredSystemFeatures() const {
 
 bool ParsedDerivation::canBuildLocally() const {
   if (drv.platform != settings.thisSystem.get() &&
-      !settings.extraPlatforms.get().count(drv.platform) && !drv.isBuiltin()) {
+      (settings.extraPlatforms.get().count(drv.platform) == 0u) &&
+      !drv.isBuiltin()) {
     return false;
   }
 
   for (auto& feature : getRequiredSystemFeatures()) {
-    if (!settings.systemFeatures.get().count(feature)) {
+    if (settings.systemFeatures.get().count(feature) == 0u) {
       return false;
     }
   }
diff --git a/third_party/nix/src/libstore/pathlocks.cc b/third_party/nix/src/libstore/pathlocks.cc
index ac6d260f8414..eeee5ee1e9c9 100644
--- a/third_party/nix/src/libstore/pathlocks.cc
+++ b/third_party/nix/src/libstore/pathlocks.cc
@@ -53,9 +53,8 @@ bool lockFile(int fd, LockType lockType, bool wait) {
       checkInterrupt();
       if (errno != EINTR) {
         throw SysError(format("acquiring/releasing lock"));
-      } else {
-        return false;
       }
+      return false;
     }
   } else {
     while (flock(fd, type | LOCK_NB) != 0) {
@@ -104,7 +103,7 @@ bool PathLocks::lockPaths(const PathSet& paths, const string& waitMsg,
       /* Acquire an exclusive lock. */
       if (!lockFile(fd.get(), ltWrite, false)) {
         if (wait) {
-          if (waitMsg != "") {
+          if (!waitMsg.empty()) {
             LOG(WARNING) << waitMsg;
           }
           lockFile(fd.get(), ltWrite, true);
diff --git a/third_party/nix/src/libstore/profiles.cc b/third_party/nix/src/libstore/profiles.cc
index 3abdfaf1389f..7d16d9f62390 100644
--- a/third_party/nix/src/libstore/profiles.cc
+++ b/third_party/nix/src/libstore/profiles.cc
@@ -31,9 +31,8 @@ static int parseName(const string& profileName, const string& name) {
   int n;
   if (string2Int(string(s, 0, p), n) && n >= 0) {
     return n;
-  } else {
-    return -1;
   }
+  return -1;
 }
 
 Generations findGenerations(Path profile, int& curGen) {
@@ -76,7 +75,7 @@ Path createGeneration(ref<LocalFSStore> store, Path profile, Path outPath) {
   Generations gens = findGenerations(profile, dummy);
 
   unsigned int num;
-  if (gens.size() > 0) {
+  if (!gens.empty()) {
     Generation last = gens.back();
 
     if (readLink(last.path) == outPath) {
@@ -165,7 +164,7 @@ void deleteGenerationsGreaterThan(const Path& profile, int max, bool dryRun) {
       continue;
     }
     if (fromCurGen) {
-      if (max) {
+      if (max != 0) {
         max--;
         continue;
       }
diff --git a/third_party/nix/src/libstore/remote-fs-accessor.cc b/third_party/nix/src/libstore/remote-fs-accessor.cc
index 819f54c161e8..9aceaa9815b5 100644
--- a/third_party/nix/src/libstore/remote-fs-accessor.cc
+++ b/third_party/nix/src/libstore/remote-fs-accessor.cc
@@ -11,14 +11,14 @@ namespace nix {
 
 RemoteFSAccessor::RemoteFSAccessor(ref<Store> store, const Path& cacheDir)
     : store(store), cacheDir(cacheDir) {
-  if (cacheDir != "") {
+  if (!cacheDir.empty()) {
     createDirs(cacheDir);
   }
 }
 
 Path RemoteFSAccessor::makeCacheFile(const Path& storePath,
                                      const std::string& ext) {
-  assert(cacheDir != "");
+  assert(!cacheDir.empty());
   return fmt("%s/%s.%s", cacheDir, storePathToHash(storePath), ext);
 }
 
@@ -26,7 +26,7 @@ void RemoteFSAccessor::addToCache(const Path& storePath, const std::string& nar,
                                   ref<FSAccessor> narAccessor) {
   nars.emplace(storePath, narAccessor);
 
-  if (cacheDir != "") {
+  if (!cacheDir.empty()) {
     try {
       std::ostringstream str;
       JSONPlaceholder jsonRoot(str);
@@ -62,7 +62,7 @@ std::pair<ref<FSAccessor>, Path> RemoteFSAccessor::fetch(const Path& path_) {
   std::string listing;
   Path cacheFile;
 
-  if (cacheDir != "" &&
+  if (!cacheDir.empty() &&
       pathExists(cacheFile = makeCacheFile(storePath, "nar"))) {
     try {
       listing = nix::readFile(makeCacheFile(storePath, "ls"));
diff --git a/third_party/nix/src/libstore/remote-store.cc b/third_party/nix/src/libstore/remote-store.cc
index 564ba444d242..c4215800da8d 100644
--- a/third_party/nix/src/libstore/remote-store.cc
+++ b/third_party/nix/src/libstore/remote-store.cc
@@ -81,9 +81,8 @@ UDSRemoteStore::UDSRemoteStore(std::string socket_path, const Params& params)
 std::string UDSRemoteStore::getUri() {
   if (path) {
     return std::string("unix://") + *path;
-  } else {
-    return "daemon";
   }
+  return "daemon";
 }
 
 ref<RemoteStore::Connection> UDSRemoteStore::openConnection() {
@@ -155,7 +154,7 @@ void RemoteStore::initConnection(Connection& conn) {
     }
 
     if (GET_PROTOCOL_MINOR(conn.daemonVersion) >= 11) {
-      conn.to << false;
+      conn.to << 0u;
     }
 
     auto ex = conn.processStderr();
@@ -171,17 +170,18 @@ void RemoteStore::initConnection(Connection& conn) {
 }
 
 void RemoteStore::setOptions(Connection& conn) {
-  conn.to << wopSetOptions << settings.keepFailed
-          << settings.keepGoing
+  conn.to << wopSetOptions << static_cast<uint64_t>(settings.keepFailed)
+          << static_cast<uint64_t>(settings.keepGoing)
           // TODO(tazjin): Remove the verbosity stuff here.
-          << settings.tryFallback << compat::kInfo << settings.maxBuildJobs
-          << settings.maxSilentTime
-          << true
+          << static_cast<uint64_t>(settings.tryFallback) << compat::kInfo
+          << settings.maxBuildJobs << settings.maxSilentTime
+          << 1u
           // TODO(tazjin): what behaviour does this toggle remotely?
           << (settings.verboseBuild ? compat::kError : compat::kVomit)
           << 0  // obsolete log type
           << 0  /* obsolete print build trace */
-          << settings.buildCores << settings.useSubstitutes;
+          << settings.buildCores
+          << static_cast<uint64_t>(settings.useSubstitutes);
 
   if (GET_PROTOCOL_MINOR(conn.daemonVersion) >= 12) {
     std::map<std::string, Config::SettingInfo> overrides;
@@ -221,7 +221,7 @@ struct ConnectionHandle {
   ConnectionHandle(ConnectionHandle&& h) : handle(std::move(h.handle)) {}
 
   ~ConnectionHandle() {
-    if (!daemonException && std::uncaught_exceptions()) {
+    if (!daemonException && (std::uncaught_exceptions() != 0)) {
       handle.markBad();
       // TODO(tazjin): are these types of things supposed to be DEBUG?
       DLOG(INFO) << "closing daemon connection because of an exception";
@@ -247,7 +247,7 @@ bool RemoteStore::isValidPathUncached(const Path& path) {
   auto conn(getConnection());
   conn->to << wopIsValidPath << path;
   conn.processStderr();
-  return readInt(conn->from);
+  return readInt(conn->from) != 0u;
 }
 
 PathSet RemoteStore::queryValidPaths(const PathSet& paths,
@@ -261,11 +261,10 @@ PathSet RemoteStore::queryValidPaths(const PathSet& paths,
       }
     }
     return res;
-  } else {
-    conn->to << wopQueryValidPaths << paths;
-    conn.processStderr();
-    return readStorePaths<PathSet>(*this, conn->from);
   }
+  conn->to << wopQueryValidPaths << paths;
+  conn.processStderr();
+  return readStorePaths<PathSet>(*this, conn->from);
 }
 
 PathSet RemoteStore::queryAllValidPaths() {
@@ -282,16 +281,15 @@ PathSet RemoteStore::querySubstitutablePaths(const PathSet& paths) {
     for (auto& i : paths) {
       conn->to << wopHasSubstitutes << i;
       conn.processStderr();
-      if (readInt(conn->from)) {
+      if (readInt(conn->from) != 0u) {
         res.insert(i);
       }
     }
     return res;
-  } else {
-    conn->to << wopQuerySubstitutablePaths << paths;
-    conn.processStderr();
-    return readStorePaths<PathSet>(*this, conn->from);
   }
+  conn->to << wopQuerySubstitutablePaths << paths;
+  conn.processStderr();
+  return readStorePaths<PathSet>(*this, conn->from);
 }
 
 void RemoteStore::querySubstitutablePathInfos(const PathSet& paths,
@@ -312,7 +310,7 @@ void RemoteStore::querySubstitutablePathInfos(const PathSet& paths,
         continue;
       }
       info.deriver = readString(conn->from);
-      if (info.deriver != "") {
+      if (!info.deriver.empty()) {
         assertStorePath(info.deriver);
       }
       info.references = readStorePaths<PathSet>(*this, conn->from);
@@ -329,7 +327,7 @@ void RemoteStore::querySubstitutablePathInfos(const PathSet& paths,
       Path path = readStorePath(*this, conn->from);
       SubstitutablePathInfo& info(infos[path]);
       info.deriver = readString(conn->from);
-      if (info.deriver != "") {
+      if (!info.deriver.empty()) {
         assertStorePath(info.deriver);
       }
       info.references = readStorePaths<PathSet>(*this, conn->from);
@@ -366,7 +364,7 @@ void RemoteStore::queryPathInfoUncached(
       info = std::make_shared<ValidPathInfo>();
       info->path = path;
       info->deriver = readString(conn->from);
-      if (info->deriver != "") {
+      if (!info->deriver.empty()) {
         assertStorePath(info->deriver);
       }
       info->narHash = Hash(readString(conn->from), htSHA256);
@@ -464,7 +462,7 @@ void RemoteStore::addToStore(const ValidPathInfo& info, Source& source,
 Path RemoteStore::addToStore(const string& name, const Path& _srcPath,
                              bool recursive, HashType hashAlgo,
                              PathFilter& filter, RepairFlag repair) {
-  if (repair) {
+  if (repair != 0u) {
     throw Error(
         "repairing is not supported when building through the Nix daemon");
   }
@@ -506,7 +504,7 @@ Path RemoteStore::addToStore(const string& name, const Path& _srcPath,
 
 Path RemoteStore::addTextToStore(const string& name, const string& s,
                                  const PathSet& references, RepairFlag repair) {
-  if (repair) {
+  if (repair != 0u) {
     throw Error(
         "repairing is not supported when building through the Nix daemon");
   }
@@ -593,7 +591,7 @@ Roots RemoteStore::findRoots(bool censor) {
   conn.processStderr();
   auto count = readNum<size_t>(conn->from);
   Roots result;
-  while (count--) {
+  while ((count--) != 0u) {
     Path link = readString(conn->from);
     Path target = readStorePath(*this, conn->from);
     result[target].emplace(link);
@@ -605,7 +603,7 @@ void RemoteStore::collectGarbage(const GCOptions& options, GCResults& results) {
   auto conn(getConnection());
 
   conn->to << wopCollectGarbage << options.action << options.pathsToDelete
-           << options.ignoreLiveness
+           << static_cast<uint64_t>(options.ignoreLiveness)
            << options.maxFreed
            /* removed options */
            << 0 << 0 << 0;
@@ -631,9 +629,9 @@ void RemoteStore::optimiseStore() {
 
 bool RemoteStore::verifyStore(bool checkContents, RepairFlag repair) {
   auto conn(getConnection());
-  conn->to << wopVerifyStore << checkContents << repair;
+  conn->to << wopVerifyStore << static_cast<uint64_t>(checkContents) << repair;
   conn.processStderr();
-  return readInt(conn->from);
+  return readInt(conn->from) != 0u;
 }
 
 void RemoteStore::addSignatures(const Path& storePath, const StringSet& sigs) {
@@ -694,14 +692,14 @@ std::exception_ptr RemoteStore::Connection::processStderr(Sink* sink,
 
     if (msg == STDERR_WRITE) {
       string s = readString(from);
-      if (!sink) {
+      if (sink == nullptr) {
         throw Error("no sink");
       }
       (*sink)(s);
     }
 
     else if (msg == STDERR_READ) {
-      if (!source) {
+      if (source == nullptr) {
         throw Error("no source");
       }
       auto len = readNum<size_t>(from);
diff --git a/third_party/nix/src/libstore/remote-store.hh b/third_party/nix/src/libstore/remote-store.hh
index f2692193433e..dc44cd32ac47 100644
--- a/third_party/nix/src/libstore/remote-store.hh
+++ b/third_party/nix/src/libstore/remote-store.hh
@@ -59,7 +59,7 @@ class RemoteStore : public virtual Store {
   void querySubstitutablePathInfos(const PathSet& paths,
                                    SubstitutablePathInfos& infos) override;
 
-  void addToStore(const ValidPathInfo& info, Source& nar, RepairFlag repair,
+  void addToStore(const ValidPathInfo& info, Source& source, RepairFlag repair,
                   CheckSigsFlag checkSigs,
                   std::shared_ptr<FSAccessor> accessor) override;
 
diff --git a/third_party/nix/src/libstore/sqlite.cc b/third_party/nix/src/libstore/sqlite.cc
index 2288277659a3..2dea952d0275 100644
--- a/third_party/nix/src/libstore/sqlite.cc
+++ b/third_party/nix/src/libstore/sqlite.cc
@@ -14,7 +14,7 @@ namespace nix {
   int exterr = sqlite3_extended_errcode(db);
 
   auto path = sqlite3_db_filename(db, nullptr);
-  if (!path) {
+  if (path == nullptr) {
     path = "(in-memory)";
   }
 
@@ -23,9 +23,8 @@ namespace nix {
         err == SQLITE_PROTOCOL
             ? fmt("SQLite database '%s' is busy (SQLITE_PROTOCOL)", path)
             : fmt("SQLite database '%s' is busy", path));
-  } else {
-    throw SQLiteError("%s: %s (in '%s')", fs.s, sqlite3_errstr(exterr), path);
   }
+  throw SQLiteError("%s: %s (in '%s')", fs.s, sqlite3_errstr(exterr), path);
 }
 
 SQLite::SQLite(const Path& path) {
@@ -38,7 +37,7 @@ SQLite::SQLite(const Path& path) {
 
 SQLite::~SQLite() {
   try {
-    if (db && sqlite3_close(db) != SQLITE_OK) {
+    if ((db != nullptr) && sqlite3_close(db) != SQLITE_OK) {
       throwSQLiteError(db, "closing database");
     }
   } catch (...) {
@@ -67,7 +66,7 @@ void SQLiteStmt::create(sqlite3* db, const string& sql) {
 
 SQLiteStmt::~SQLiteStmt() {
   try {
-    if (stmt && sqlite3_finalize(stmt) != SQLITE_OK) {
+    if ((stmt != nullptr) && sqlite3_finalize(stmt) != SQLITE_OK) {
       throwSQLiteError(db, fmt("finalizing statement '%s'", sql));
     }
   } catch (...) {
diff --git a/third_party/nix/src/libstore/ssh.cc b/third_party/nix/src/libstore/ssh.cc
index d549d5c3657b..06aaf285f1b5 100644
--- a/third_party/nix/src/libstore/ssh.cc
+++ b/third_party/nix/src/libstore/ssh.cc
@@ -12,7 +12,7 @@ SSHMaster::SSHMaster(const std::string& host, std::string keyFile,
       useMaster(useMaster && !fakeSSH),
       compress(compress),
       logFD(logFD) {
-  if (host == "" || hasPrefix(host, "-")) {
+  if (host.empty() || hasPrefix(host, "-")) {
     throw Error("invalid SSH host name '%s'", host);
   }
 }
@@ -33,7 +33,8 @@ std::unique_ptr<SSHMaster::Connection> SSHMaster::startCommand(
     const std::string& command) {
   Path socketPath = startMaster();
 
-  Pipe in, out;
+  Pipe in;
+  Pipe out;
   in.create();
   out.create();
 
@@ -63,9 +64,9 @@ std::unique_ptr<SSHMaster::Connection> SSHMaster::startCommand(
         if (fakeSSH) {
           args = {"bash", "-c"};
         } else {
-          args = {"ssh", host.c_str(), "-x", "-a"};
+          args = {"ssh", host, "-x", "-a"};
           addCommonSSHOpts(args);
-          if (socketPath != "") {
+          if (!socketPath.empty()) {
             args.insert(args.end(), {"-S", socketPath});
           }
           // TODO(tazjin): Abseil verbosity flag
@@ -123,7 +124,7 @@ Path SSHMaster::startMaster() {
           throw SysError("duping over stdout");
         }
 
-        Strings args = {"ssh", host.c_str(),
+        Strings args = {"ssh", host,
                         "-M",  "-N",
                         "-S",  state->socketPath,
                         "-o",  "LocalCommand=echo started",
diff --git a/third_party/nix/src/libstore/store-api.cc b/third_party/nix/src/libstore/store-api.cc
index 84b5841a82e6..39cb5ca9f6c8 100644
--- a/third_party/nix/src/libstore/store-api.cc
+++ b/third_party/nix/src/libstore/store-api.cc
@@ -37,9 +37,8 @@ Path Store::toStorePath(const Path& path) const {
   Path::size_type slash = path.find('/', storeDir.size() + 1);
   if (slash == Path::npos) {
     return path;
-  } else {
-    return Path(path, 0, slash);
   }
+  return Path(path, 0, slash);
 }
 
 Path Store::followLinksToStore(const Path& _path) const {
@@ -333,7 +332,7 @@ void Store::queryPathInfo(const Path& storePath,
               res.first == NarInfoDiskCache::oInvalid ? nullptr : res.second);
           if (res.first == NarInfoDiskCache::oInvalid ||
               (res.second->path != storePath &&
-               storePathToName(storePath) != "")) {
+               !storePathToName(storePath).empty())) {
             throw InvalidPath(format("path '%s' is not valid") % storePath);
           }
         }
@@ -362,8 +361,8 @@ void Store::queryPathInfo(const Path& storePath,
             state_->pathInfoCache.upsert(hashPart, info);
           }
 
-          if (!info ||
-              (info->path != storePath && storePathToName(storePath) != "")) {
+          if (!info || (info->path != storePath &&
+                        !storePathToName(storePath).empty())) {
             stats.narInfoMissing++;
             throw InvalidPath("path '%s' is not valid", storePath);
           }
@@ -401,7 +400,7 @@ PathSet Store::queryValidPaths(const PathSet& paths,
             state->exc = std::current_exception();
           }
           assert(state->left);
-          if (!--state->left) {
+          if (--state->left == 0u) {
             wakeup.notify_one();
           }
         }});
@@ -415,7 +414,7 @@ PathSet Store::queryValidPaths(const PathSet& paths,
 
   while (true) {
     auto state(state_.lock());
-    if (!state->left) {
+    if (state->left == 0u) {
       if (state->exc) {
         std::rethrow_exception(state->exc);
       }
@@ -430,7 +429,7 @@ PathSet Store::queryValidPaths(const PathSet& paths,
    responsibility of the caller to provide a closure. */
 string Store::makeValidityRegistration(const PathSet& paths, bool showDerivers,
                                        bool showHash) {
-  string s = "";
+  string s = s;
 
   for (auto& i : paths) {
     s += i + "\n";
@@ -478,7 +477,7 @@ void Store::pathInfoToJSON(JSONPlaceholder& jsonOut, const PathSet& storePaths,
         }
       }
 
-      if (info->ca != "") {
+      if (!info->ca.empty()) {
         jsonPath.attr("ca", info->ca);
       }
 
@@ -490,11 +489,11 @@ void Store::pathInfoToJSON(JSONPlaceholder& jsonOut, const PathSet& storePaths,
       }
 
       if (includeImpureInfo) {
-        if (info->deriver != "") {
+        if (!info->deriver.empty()) {
           jsonPath.attr("deriver", info->deriver);
         }
 
-        if (info->registrationTime) {
+        if (info->registrationTime != 0) {
           jsonPath.attr("registrationTime", info->registrationTime);
         }
 
@@ -519,7 +518,7 @@ void Store::pathInfoToJSON(JSONPlaceholder& jsonOut, const PathSet& storePaths,
           if (narInfo->fileHash) {
             jsonPath.attr("downloadHash", narInfo->fileHash.to_string());
           }
-          if (narInfo->fileSize) {
+          if (narInfo->fileSize != 0u) {
             jsonPath.attr("downloadSize", narInfo->fileSize);
           }
           if (showClosureSize) {
@@ -535,7 +534,8 @@ void Store::pathInfoToJSON(JSONPlaceholder& jsonOut, const PathSet& storePaths,
 }
 
 std::pair<uint64_t, uint64_t> Store::getClosureSize(const Path& storePath) {
-  uint64_t totalNarSize = 0, totalDownloadSize = 0;
+  uint64_t totalNarSize = 0;
+  uint64_t totalDownloadSize = 0;
   PathSet closure;
   computeFSClosure(storePath, closure, false, false);
   for (auto& p : closure) {
@@ -596,7 +596,7 @@ void copyStorePath(ref<Store> srcStore, ref<Store> dstStore,
     srcStore->narFromPath({storePath}, sink);
     auto info2 = make_ref<ValidPathInfo>(*info);
     info2->narHash = hashString(htSHA256, *sink.s);
-    if (!info->narSize) {
+    if (info->narSize == 0u) {
       info2->narSize = sink.s->size();
     }
     if (info->ultimate) {
@@ -638,7 +638,7 @@ void copyPaths(ref<Store> srcStore, ref<Store> dstStore,
 
   PathSet missing;
   for (auto& path : storePaths) {
-    if (!valid.count(path)) {
+    if (valid.count(path) == 0u) {
       missing.insert(path);
     }
   }
@@ -724,7 +724,7 @@ ValidPathInfo decodeValidPathInfo(std::istream& str, bool hashGiven) {
   if (!string2Int(s, n)) {
     throw Error("number expected");
   }
-  while (n--) {
+  while ((n--) != 0) {
     getline(str, s);
     info.references.insert(s);
   }
@@ -737,7 +737,7 @@ ValidPathInfo decodeValidPathInfo(std::istream& str, bool hashGiven) {
 string showPaths(const PathSet& paths) {
   string s;
   for (auto& i : paths) {
-    if (s.size() != 0) {
+    if (!s.empty()) {
       s += ", ";
     }
     s += "'" + i + "'";
@@ -769,9 +769,9 @@ bool ValidPathInfo::isContentAddressed(const Store& store) const {
     Hash hash(std::string(ca, 5));
     if (store.makeTextPath(storePathToName(path), hash, references) == path) {
       return true;
-    } else {
-      warn();
     }
+    warn();
+
   }
 
   else if (hasPrefix(ca, "fixed:")) {
@@ -781,9 +781,8 @@ bool ValidPathInfo::isContentAddressed(const Store& store) const {
         store.makeFixedOutputPath(recursive, hash, storePathToName(path)) ==
             path) {
       return true;
-    } else {
-      warn();
     }
+    warn();
   }
 
   return false;
@@ -900,12 +899,14 @@ ref<Store> openStore(const std::string& uri_,
 StoreType getStoreType(const std::string& uri, const std::string& stateDir) {
   if (uri == "daemon") {
     return tDaemon;
-  } else if (uri == "local" || hasPrefix(uri, "/")) {
+  }
+  if (uri == "local" || hasPrefix(uri, "/")) {
     return tLocal;
-  } else if (uri == "" || uri == "auto") {
+  } else if (uri.empty() || uri == "auto") {
     if (access(stateDir.c_str(), R_OK | W_OK) == 0) {
       return tLocal;
-    } else if (pathExists(settings.nixDaemonSocketFile)) {
+    }
+    if (pathExists(settings.nixDaemonSocketFile)) {
       return tDaemon;
     } else {
       return tLocal;
@@ -940,7 +941,7 @@ std::list<ref<Store>> getDefaultSubstituters() {
     StringSet done;
 
     auto addStore = [&](const std::string& uri) {
-      if (done.count(uri)) {
+      if (done.count(uri) != 0u) {
         return;
       }
       done.insert(uri);
diff --git a/third_party/nix/src/libstore/store-api.hh b/third_party/nix/src/libstore/store-api.hh
index e8c78b7a64e7..17299585edaf 100644
--- a/third_party/nix/src/libstore/store-api.hh
+++ b/third_party/nix/src/libstore/store-api.hh
@@ -533,12 +533,12 @@ class Store : public std::enable_shared_from_this<Store>, public Config {
      `storePath' is returned; that is, the closures under the
      `referrers' relation instead of the `references' relation is
      returned. */
-  virtual void computeFSClosure(const PathSet& paths, PathSet& out,
+  virtual void computeFSClosure(const PathSet& paths, PathSet& paths_,
                                 bool flipDirection = false,
                                 bool includeOutputs = false,
                                 bool includeDerivers = false);
 
-  void computeFSClosure(const Path& path, PathSet& out,
+  void computeFSClosure(const Path& path, PathSet& paths_,
                         bool flipDirection = false, bool includeOutputs = false,
                         bool includeDerivers = false);
 
-- 
cgit 1.4.1