loqusion/typix

Adding a path from the local source tree to `virtualPaths` is dangerous when `forceVirtualPaths` is `true`

loqusion opened this issue · 0 comments

(Doing this in the first place is an anti-pattern, but something should probably be done to prevent the user from accidentally shooting themselves in the foot like this.)

If you add something in virtualPaths like:

watchTypstProject {
  virtualPaths = [
    ./local-file
  ];
  forceVirtualPaths = true;
}

When forceVirtualPaths is true and you use devShell or watchTypstProject, ./local-file will be overwritten with a symlink to the file that was copied to the Nix store, resulting in the potential for the original contents of the file to be lost permanently.

One of two things should probably be done here:

  • If a virtualPaths elem refers to the local source tree, avoid creating a symlink in devShell and watchTypstProject if it would overwrite itself
  • Make any references to the local source tree in virtualPaths entirely impossible, forcing the user to use something like lib.fileset.unions in src