fix: replace builtins.appendContext with context-carrying concatenation (#2482)

* fix: replace builtins.appendContext with context-carrying concatenation

builtins.appendContext validates that store paths exist locally, which
fails when paths come from flake inputs that aren't available on the
evaluating machine (e.g. CHaP in cardano-node builds).

Instead, preserve string context through parsing by using
builtins.substring 0 0 to capture context from input strings and
re-attach it via concatenation after builtins.match/split strip it.

- parseBlockLines: carry context from input lines to parsed attr values
- parseSourceRepositoryPackages: carry context through builtins.split
- extractSourceRepoPackageData: use unsafeDiscardStringContext for
  sha256map attribute name lookups
- parseRepositoryBlock: remove addContext helper that used appendContext,
  use attrs.url directly (context now preserved by parseBlockLines)
- call-cabal-project-to-nix: remove appendContext on writeText, export
  rawCabalProjectContext for use by load-cabal-plan
- load-cabal-plan: use rawCabalProjectContext concatenation instead of
  appendContext

Add unit tests verifying context flows through parseBlockLines and
parseSourceRepositoryPackages.

* Bump head.hackage

Author: hamishmack

lib/cabal-project-parser.nix

@@ -42,12 +42,19 @@ let
     );
 
   # Parse lines of a source-repository-package block
-  parseBlockLines = blockLines: (pkgs.lib.foldl' ({name, attrs}: s:
+  parseBlockLines = blockLines:
+    let
+      # builtins.match strips string context. Capture the context from the input
+      # lines so we can re-attach it to parsed values via string concatenation.
+      # Using substring+concatenation instead of builtins.appendContext because
+      # appendContext can fail for store paths that don't exist locally.
+      contextStr = builtins.substring 0 0 (builtins.concatStringsSep "" blockLines);
+    in (pkgs.lib.foldl' ({name, attrs}: s:
     let
       # Look for a new attribute name
       pair = builtins.match "([^ :]*): *(.*)" s;
       trim = x: let m = builtins.match "(.*[^ \t])[ \t]*" x;
-        in pkgs.lib.optionalString (m != null) (builtins.head m);
+        in pkgs.lib.optionalString (m != null) (contextStr + builtins.head m);
 
       # Function to build the next parse state when the attribute name is known
       nextState = name: value: {
@@ -67,7 +74,7 @@ let
           nextState (builtins.head pair) (trim (builtins.elemAt pair 1))
         else
           if name != null
-            then nextState name s # Append another line to the current attribute
+            then nextState name (contextStr + s) # Append another line to the current attribute
             else __trace "Expected attribute but found `${s}`" { inherit name attrs; }
     ) { name = null; attrs = {}; } (stripComments (unindent blockLines))).attrs;
 
@@ -82,12 +89,15 @@ let
         if builtins.match "[0-9a-f]{40}" repo.tag != null
           then "rev"
           else "ref";
+      # Strip context for attribute name lookups
+      locationNoContext = builtins.unsafeDiscardStringContext repo.location;
+      tagNoContext = builtins.unsafeDiscardStringContext repo.tag;
     in {
     url = repo.location;
     "${refOrRev}" = repo.tag;
     sha256 = repo."--sha256" or (
-      if sha256map != null && sha256map ? ${repo.location}
-        then sha256map.${repo.location}.${repo.tag}
+      if sha256map != null && sha256map ? ${locationNoContext}
+        then sha256map.${locationNoContext}.${tagNoContext}
         else null);
     subdirs = if repo ? subdir
       then pkgs.lib.filter (x: x != "") (pkgs.lib.splitString " " repo.subdir)
@@ -100,7 +110,7 @@ let
     let
       x = span (pkgs.lib.strings.hasPrefix (indentation + " ")) (pkgs.lib.splitString "\n" block);
       attrs = parseBlockLines x.fst;
-      overrideSourceRepo = sourceRepo: (source-repo-override.${sourceRepo.url} or (pkgs.lib.id)) sourceRepo;
+      overrideSourceRepo = sourceRepo: (source-repo-override.${builtins.unsafeDiscardStringContext sourceRepo.url} or (pkgs.lib.id)) sourceRepo;
     in
       if attrs."type" or "" != "git"
         then {
@@ -115,11 +125,15 @@ let
   parseSourceRepositoryPackages = cabalProjectFileName: sha256map: source-repo-override: projectFile:
     let
       splitResult = builtins.split "\n( *)source-repository-package\n" ("\n" + projectFile);
+      # builtins.split strips string context. Use substring to create a zero-length
+      # string with the original context, then prepend it to carry context through
+      # via concatenation (which doesn't validate paths like appendContext does).
+      contextStr = builtins.substring 0 0 projectFile;
       # Construct a list of strings with just the indentation amounts for each map
       indentations = builtins.concatLists (builtins.filter builtins.isList splitResult);
       blocks = builtins.filter builtins.isString (pkgs.lib.lists.drop 1 splitResult);
     in {
-      initialText = builtins.head splitResult;
+      initialText = contextStr + builtins.head splitResult;
       sourceRepos = pkgs.lib.zipListsWith (parseSourceRepositoryPackageBlock cabalProjectFileName sha256map source-repo-override)
         indentations blocks;
     };
@@ -136,21 +150,18 @@ let
       # The first line will contain the repository name.
       x = span (pkgs.lib.strings.hasPrefix " ") (__tail lines);
       attrs = parseBlockLines x.fst;
+      # Strip context for attribute name lookups (context on attrs values
+      # can cause "not allowed to refer to a store path" errors in attr names)
+      urlNoContext = builtins.unsafeDiscardStringContext attrs.url;
       sha256 = attrs."--sha256" or (
         if sha256map != null
-          then sha256map.${attrs.url} or null
+          then sha256map.${urlNoContext} or null
           else null);
-      # Find store directory strings and include them in the string context
-      addContext = s:
-        let storeDirMatch = builtins.match ".*(${builtins.storeDir}/[^/]+).*" s;
-        in if storeDirMatch == null
-          then s
-          else builtins.appendContext s { ${builtins.head storeDirMatch} = { path = true; }; };
     in rec {
       # This is `some-name` from the `repository some-name` line in the `cabal.project` file.
       name = builtins.unsafeDiscardStringContext (__head lines);
       # The $HOME/.cabal/packages/${name} after running `cabal v2-update` to download the repository
-      repoContents = if inputMap ? ${attrs.url}
+      repoContents = if inputMap ? ${urlNoContext}
         # If there is an input use it to make `file:` url and create a suitable `.cabal/packages/${name}` directory
         then evalPackages.runCommand name ({
           nativeBuildInputs = [ nix-tools.exes.cabal ] ++ evalPackages.haskell-nix.cabal-issue-8352-workaround;
@@ -160,7 +171,7 @@ let
             mkdir -p $HOME/.cabal/packages/${name}
             cat <<EOF > $HOME/.cabal/config
             repository ${name}
-              url: file:${inputMap.${attrs.url}}
+              url: file:${inputMap.${urlNoContext}}
               ${pkgs.lib.optionalString (attrs ? secure) "secure: ${attrs.secure}"}
               ${pkgs.lib.optionalString (attrs ? root-keys) "root-keys: ${attrs.root-keys}"}
               ${pkgs.lib.optionalString (attrs ? key-threshold) "key-threshold: ${attrs.key-threshold}"}
@@ -182,7 +193,7 @@ let
             mkdir -p $HOME/.cabal/packages/${name}
             cat <<EOF > $HOME/.cabal/config
             repository ${name}
-              url: ${addContext attrs.url}
+              url: ${attrs.url}
               ${pkgs.lib.optionalString (attrs ? secure) "secure: ${attrs.secure}"}
               ${pkgs.lib.optionalString (attrs ? root-keys) "root-keys: ${attrs.root-keys}"}
               ${pkgs.lib.optionalString (attrs ? key-threshold) "key-threshold: ${attrs.key-threshold}"}

lib/call-cabal-project-to-nix.nix

@@ -264,11 +264,7 @@ let
       inherit (repoResult) repos extra-hackages;
       makeFixedProjectFile = ''
         HOME=$(mktemp -d)
-        cp -f ${evalPackages.writeText "cabal.project" (
-          # Add the string context of rawCabalProject to make sure
-          # any nix store paths are included as build inputs.
-          builtins.appendContext sourceRepoFixedProjectFile
-            (builtins.getContext rawCabalProject))} ./cabal.project
+        cp -f ${evalPackages.writeText "cabal.project" sourceRepoFixedProjectFile} ./cabal.project
         chmod +w -R ./cabal.project
       '' + pkgs.lib.strings.concatStrings (
             map (f: ''
@@ -779,4 +775,8 @@ in {
   projectNix = plan-json;
   inherit index-state-max src;
   inherit (fixedProject) sourceRepos extra-hackages;
+  # Zero-length string carrying context from rawCabalProject.
+  # Used in load-cabal-plan.nix to add context to URLs referencing store paths
+  # without using builtins.appendContext (which fails for non-local paths).
+  rawCabalProjectContext = builtins.substring 0 0 rawCabalProject;
 }

lib/load-cabal-plan.nix

@@ -5,12 +5,14 @@ let
   plan-json = builtins.fromJSON (
     builtins.unsafeDiscardStringContext (
       builtins.readFile (callProjectResults.projectNix + "/plan.json")));
-  # Function to add context back to the strings we get from `plan.json`
+  # Add context back to strings from `plan.json` that reference store paths.
+  # Uses concatenation with a zero-length context string instead of
+  # builtins.appendContext (which fails for store paths that don't exist locally).
   addContext = s:
     let storeDirMatch = builtins.match ".*(${builtins.storeDir}/[^/]+).*" s;
     in if storeDirMatch == null
       then s
-      else builtins.appendContext s { ${builtins.head storeDirMatch} = { path = true; }; };
+      else callProjectResults.rawCabalProjectContext + s;
   # All the units in the plan indexed by unit ID.
   by-id = pkgs.lib.listToAttrs (map (x: { name = x.id; value = x; }) plan-json.install-plan);
   # Find the names of all the pre-existing packages used by a list of dependencies

test/cabal.project.local

@@ -22,7 +22,7 @@ repository head.hackage.ghc.haskell.org
      f76d08be13e9a61a377a85e2fb63f4c5435d40f8feb3e12eb05905edb8cdea89
      26021a13b401500c8eb2761ca95c61f2d625bfef951b939a8124ed12ecf07329
      7541f32a4ccca4f97aea3b22f5e593ba2c0267546016b992dfadcd2fe944e55d
-  --sha256: sha256-RVMjsE1Lmk3SonOuHbGc2cd7gzJWyDPGehGZteWumS8=
+  --sha256: sha256-b9w0Zl7/VlvmVToocpMRE6T0O8xf/8H2qDczv8B/iiM=
 
 repository ghcjs-overlay
   url: https://raw.githubusercontent.com/input-output-hk/hackage-overlay-ghcjs/ffb32dce467b9a4d27be759fdd2740a6edd09d0b

test/unit.nix

@@ -122,6 +122,51 @@ lib.runTests {
     };
   };
 
+  # Verify that parseBlockLines (called inside parseSourceRepositoryPackageBlock)
+  # preserves string context on parsed attribute values like `location`.
+  # This is critical for repository blocks where the URL may contain
+  # interpolated store paths (e.g. `url: file:${CHaP}`).
+  testParseBlockLinesPreservesContext =
+    let
+      storePath = builtins.toFile "test-context" "test";
+      storePathStr = builtins.unsafeDiscardStringContext storePath;
+      # Interpolate a store path into the block to give it context.
+      # pkgs.lib.splitString (used inside parseSourceRepositoryPackageBlock)
+      # preserves this context, but builtins.match (used in parseBlockLines)
+      # would strip it without our fix.
+      blockWithContext = ''
+          type: git
+          location: file:${storePath}
+          tag: 487eea1c249537d34c27f6143dff2b9d5586c657
+          --sha256: 077j5j3j86qy1wnabjlrg4dmqy1fv037dyq3xb8ch4ickpxxs123
+        rest of file
+      '';
+      result = haskellLib.parseSourceRepositoryPackageBlock "cabal.project" {} {} "" blockWithContext;
+      urlContext = builtins.getContext result.sourceRepo.url;
+    in {
+      expr = urlContext ? ${storePathStr};
+      expected = true;
+    };
+
+  # Verify that parseSourceRepositoryPackages preserves string context
+  # from the project file through builtins.split into initialText.
+  testParseSourceRepoPackagesPreservesContext =
+    let
+      storePath = builtins.toFile "test-context" "test";
+      storePathStr = builtins.unsafeDiscardStringContext storePath;
+      projectFile = ''
+        packages: ./*.cabal
+        repository test-repo
+          url: file:${storePath}
+          secure: True
+      '';
+      result = haskellLib.parseSourceRepositoryPackages "cabal.project" {} {} projectFile;
+      initialTextContext = builtins.getContext result.initialText;
+    in {
+      expr = initialTextContext ? ${storePathStr};
+      expected = true;
+    };
+
   testParseRepositoryBlock =
     let
       # The Cabal2Nix output in hackage-to-nix is imported into a lambda