nixos/security.acme: remove with lib;

[Stunkymonkey]

Description of changes

part of #208242

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[emilazy]

@ofborg test acme

[m1cr0man]

Correct me if I'm wrong but builtins.lib is not a thing? It seems some mass replace was done across the file.

[emilazy]

Yeah, this needs fixing.

[Stunkymonkey]

@emilazy & @m1cr0man should be fixed.

[Stunkymonkey]

@ofborg test acme

[m1cr0man]

Question (non blockers just my own curiosity): what's the value of removing "with lib" entirely as per the parent ticket? I also wonder if a "let inherit (lib) ...” pattern is worth considering to preserve the blame on the lines/keep common values in scope?

[emilazy]

with disables static scope checking for its whole body (i.e. with lib; if complicatedCondition then … varaible … else … is a runtime error waiting to happen), and has very unintuitive behaviour around variable shadowing. It’s controversial in general but there’s more‐or‐less consensus to avoid whole file bodies being inside a with at this point. (And insofar as my vote as someone who hasn’t touched the ACME code in a few years counts, I’m definitely in favour of dropping it.)

I am personally agnostic to explicit lib vs. let inherit. I write the former, but the latter is fine too. Opinions seem generally divided on the matter.

[m1cr0man]

Thanks for the explanation 🙂 this change makes a lot of sense now.

[Stunkymonkey]

@ofborg test acme

[philiptaron]

nix-build -A nixosTests.acme passes.

[m1cr0man]

Looks good 🙂