From 5b586575ac5ecb013be56135ecbcb091c8ad419d Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 10 Feb 2022 14:12:06 +0100
Subject: [PATCH 01/52] nix/why-depends: fix output when not using `--precise`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On Nix 2.6 the output of `nix why-depends --all` seems to be somewhat
off:

    $ nix why-depends /nix/store/kn47hayxab8gc01jhr98dwyywbx561aq-nixos-system-roflmayr-21.11.20220207.6c202a9.drv /nix/store/srn5jbs1q30jpybdmxqrwskyny659qgc-nix-2.6.drv --derivation  --extra-experimental-features nix-command  --all
    /nix/store/kn47hayxab8gc01jhr98dwyywbx561aq-nixos-system-roflmayr-21.11.20220207.6c202a9.drv
        └───/nix/store/g8bpgfjhh5vxrdq0w6r6s64f9kkm9z6c-etc.drv
        │   └───/nix/store/hm0jmhp8shbf3cl846a685nv4f5cp3fy-nspawn-inst.drv
        | [...]
            └───/nix/store/2d6q3ygiim9ijl5d4h0qqx6vnjgxywyr-system-units.drv
                └───/nix/store/dil014y1b8qyjhhhf5fpaah5fzdf0bzs-unit-systemd-nspawn-hydra.service.drv
                    └───/nix/store/a9r72wwx8qrxyp7hjydyg0gsrwnn26zb-activate.drv
                        └───/nix/store/99hlc7i4gl77wq087lbhag4hkf3kvssj-nixos-system-hydra-21.11pre-git.drv

Please note that `[...]-system-units.drv` is supposed to be a direct
child of `[...]-etc.drv`.

The reason for that is that each new level printed by `printNode` is
four spaces off in comparison to `nix why-depends --precise` because the
recursive `printNode()` only prints the path and not the `tree*`-chars in
the case of `--precise` and in this format the path is four spaces further
indented, i.e. on a newline, but on the same level as the path's children, i.e.

    /nix/store/kn47hayxab8gc01jhr98dwyywbx561aq-nixos-system-roflmayr-21.11.20220207.6c202a9.drv
    └───/: …1-p8.drv",["out"]),("/nix/store/g8bpgfjhh5vxrdq0w6r6s64f9kkm9z6c-etc.drv",["out"]),("/nix/store/…
        → /nix/store/g8bpgfjhh5vxrdq0w6r6s64f9kkm9z6c-etc.drv

As you can see `[...]-etc.drv` is a direct child of the root, but four
spaces indented. This logic was directly applied to the code-path with
`precise=false` which resulted in `tree*` being printed four spaces too
deep.

In case of no `--precise`, `hits[hash]` is empty and the path itself
should be printed rather than hits using the same logic as for `hits[hash]`.

With this fix, the output looks correct now:

    /nix/store/kn47hayxab8gc01jhr98dwyywbx561aq-nixos-system-roflmayr-21.11.20220207.6c202a9.drv
    └───/nix/store/g8bpgfjhh5vxrdq0w6r6s64f9kkm9z6c-etc.drv
        ├───/nix/store/hm0jmhp8shbf3cl846a685nv4f5cp3fy-nspawn-inst.drv
        | [...]
        └───/nix/store/2d6q3ygiim9ijl5d4h0qqx6vnjgxywyr-system-units.drv
            └───/nix/store/dil014y1b8qyjhhhf5fpaah5fzdf0bzs-unit-systemd-nspawn-hydra.service.drv
                └───/nix/store/a9r72wwx8qrxyp7hjydyg0gsrwnn26zb-activate.drv
                    └───/nix/store/99hlc7i4gl77wq087lbhag4hkf3kvssj-nixos-system-hydra-21.11pre-git.drv
---
 src/nix/why-depends.cc | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/src/nix/why-depends.cc b/src/nix/why-depends.cc
index 657df30d7..bc8cfb1c5 100644
--- a/src/nix/why-depends.cc
+++ b/src/nix/why-depends.cc
@@ -171,12 +171,6 @@ struct CmdWhyDepends : SourceExprCommand
                     node.visited ? "\e[38;5;244m" : "",
                     firstPad != "" ? "→ " : "",
                     pathS);
-            } else {
-                logger->cout("%s%s%s%s" ANSI_NORMAL,
-                    firstPad,
-                    node.visited ? "\e[38;5;244m" : "",
-                    firstPad != "" ? treeLast : "",
-                    pathS);
             }
 
             if (node.path == dependencyPath && !all
@@ -184,7 +178,7 @@ struct CmdWhyDepends : SourceExprCommand
                 throw BailOut();
 
             if (node.visited) return;
-            node.visited = true;
+            if (precise) node.visited = true;
 
             /* Sort the references by distance to `dependency` to
                ensure that the shortest path is printed first. */
@@ -267,6 +261,16 @@ struct CmdWhyDepends : SourceExprCommand
                     if (!all) break;
                 }
 
+                if (!precise) {
+                    auto pathS = store->printStorePath(ref.second->path);
+                    logger->cout("%s%s%s%s" ANSI_NORMAL,
+                        firstPad,
+                        ref.second->visited ? "\e[38;5;244m" : "",
+                        last ? treeLast : treeConn,
+                        pathS);
+                    node.visited = true;
+                }
+
                 printNode(*ref.second,
                     tailPad + (last ? treeNull : treeLine),
                     tailPad + (last ? treeNull : treeLine));
@@ -275,6 +279,9 @@ struct CmdWhyDepends : SourceExprCommand
 
         RunPager pager;
         try {
+            if (!precise) {
+                logger->cout("%s", store->printStorePath(graph.at(packagePath).path));
+            }
             printNode(graph.at(packagePath), "", "");
         } catch (BailOut & ) { }
     }

From 72e8f94081290784e2d115cfbf09375b53d8cbe9 Mon Sep 17 00:00:00 2001
From: Gabriel Fontes <eu@misterio.me>
Date: Wed, 6 Oct 2021 13:32:46 -0300
Subject: [PATCH 02/52] add sourcehut input scheme

---
 src/libfetchers/github.cc | 91 ++++++++++++++++++++++++++++++++++++++-
 src/nix/flake.md          | 32 ++++++++++++++
 2 files changed, 122 insertions(+), 1 deletion(-)

diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index 1c539b80e..e101aa3d6 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -8,6 +8,7 @@
 
 #include <optional>
 #include <nlohmann/json.hpp>
+#include <fstream>
 
 namespace nix::fetchers {
 
@@ -17,7 +18,7 @@ struct DownloadUrl
     Headers headers;
 };
 
-// A github or gitlab host
+// A github, gitlab, or sourcehut host
 const static std::string hostRegexS = "[a-zA-Z0-9.]*"; // FIXME: check
 std::regex hostRegex(hostRegexS, std::regex::ECMAScript);
 
@@ -348,7 +349,95 @@ struct GitLabInputScheme : GitArchiveInputScheme
     }
 };
 
+struct SourceHutInputScheme : GitArchiveInputScheme
+{
+    std::string type() override { return "sourcehut"; }
+
+    std::optional<std::pair<std::string, std::string>> accessHeaderFromToken(const std::string & token) const override
+    {
+        // SourceHut supports both PAT and OAuth2. See
+        // https://man.sr.ht/meta.sr.ht/oauth.md
+        return std::pair<std::string, std::string>("Authorization", fmt("Bearer %s", token));
+        // Note: This currently serves no purpose, as this kind of authorization
+        // does not allow for downloading tarballs on sourcehut private repos.
+        // Once it is implemented, however, should work as expected.
+    }
+
+    Hash getRevFromRef(nix::ref<Store> store, const Input & input) const override
+    {
+        // TODO: In the future, when the sourcehut graphql API is implemented for mercurial
+        // and with anonymous access, this method should use it instead.
+
+        auto ref = *input.getRef();
+
+        auto host = maybeGetStrAttr(input.attrs, "host").value_or("git.sr.ht");
+        auto base_url = fmt("https://%s/%s/%s",
+            host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo"));
+
+        Headers headers = makeHeadersWithAuthTokens(host);
+
+        std::string ref_uri;
+        if (ref == "HEAD") {
+            auto file = store->toRealPath(
+                downloadFile(store, fmt("%s/HEAD", base_url), "source", false, headers).storePath);
+            std::ifstream is(file);
+            std::string line;
+            getline(is, line);
+
+            auto ref_index = line.find("ref: ");
+            if (ref_index == std::string::npos) {
+                throw BadURL("in '%d', couldn't resolve HEAD ref '%d'", input.to_string(), ref);
+            }
+
+            ref_uri = line.substr(ref_index+5, line.length()-1);
+        } else
+            ref_uri = fmt("refs/heads/%s", ref);
+
+        auto file = store->toRealPath(
+            downloadFile(store, fmt("%s/info/refs", base_url), "source", false, headers).storePath);
+        std::ifstream is(file);
+
+        std::string line;
+        std::string id;
+        while(getline(is, line)) {
+            auto index = line.find(ref_uri);
+            if (index != std::string::npos) {
+                id = line.substr(0, index-1);
+                break;
+            }
+        }
+
+        if(id.empty())
+            throw BadURL("in '%d', couldn't find ref '%d'", input.to_string(), ref);
+
+        auto rev = Hash::parseAny(id, htSHA1);
+        debug("HEAD revision for '%s' is %s", fmt("%s/%s", base_url, ref), rev.gitRev());
+        return rev;
+    }
+
+    DownloadUrl getDownloadUrl(const Input & input) const override
+    {
+        auto host = maybeGetStrAttr(input.attrs, "host").value_or("git.sr.ht");
+        auto url = fmt("https://%s/%s/%s/archive/%s.tar.gz",
+            host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo"),
+            input.getRev()->to_string(Base16, false));
+
+        Headers headers = makeHeadersWithAuthTokens(host);
+        return DownloadUrl { url, headers };
+    }
+
+    void clone(const Input & input, const Path & destDir) override
+    {
+        auto host = maybeGetStrAttr(input.attrs, "host").value_or("git.sr.ht");
+        Input::fromURL(fmt("git+https://%s/%s/%s",
+                host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo")))
+            .applyOverrides(input.getRef(), input.getRev())
+            .clone(destDir);
+    }
+};
+
 static auto rGitHubInputScheme = OnStartup([] { registerInputScheme(std::make_unique<GitHubInputScheme>()); });
 static auto rGitLabInputScheme = OnStartup([] { registerInputScheme(std::make_unique<GitLabInputScheme>()); });
+static auto rSourceHutInputScheme = OnStartup([] { registerInputScheme(std::make_unique<SourceHutInputScheme>()); });
 
 }
diff --git a/src/nix/flake.md b/src/nix/flake.md
index accddd436..f539a7c28 100644
--- a/src/nix/flake.md
+++ b/src/nix/flake.md
@@ -209,6 +209,38 @@ Currently the `type` attribute can be one of the following:
   * `github:edolstra/dwarffs/unstable`
   * `github:edolstra/dwarffs/d3f2baba8f425779026c6ec04021b2e927f61e31`
 
+* `sourcehut`: Similar to `github`, is a more efficient way to fetch
+  SourceHut repositories. The following attributes are required:
+
+  * `owner`: The owner of the repository (including leading `~`).
+
+  * `repo`: The name of the repository.
+
+  Like `github`, these are downloaded as tarball archives.
+
+  The URL syntax for `sourcehut` flakes is:
+
+  `sourcehut:<owner>/<repo>(/<rev-or-ref>)?(\?<params>)?`
+
+  `<rev-or-ref>` works the same as `github`. Either a branch or tag name
+  (`ref`), or a commit hash (`rev`) can be specified.
+
+  Since SourceHut allows for self-hosting, you can specify `host` as
+  a parameter, to point to any instances other than `git.sr.ht`.
+
+  Currently, `ref` name resolution only works for Git repositories.
+  You can refer to Mercurial repositories by simply changing `host` to
+  `hg.sr.ht` (or any other Mercurial instance). With the caveat
+  that you must explicitly specify a commit hash (`rev`).
+
+  Some examples:
+
+  * `sourcehut:~misterio/nix-colors`
+  * `sourcehut:~misterio/nix-colors/main`
+  * `sourcehut:~misterio/nix-colors?host=git.example.org`
+  * `sourcehut:~misterio/nix-colors/182b4b8709b8ffe4e9774a4c5d6877bf6bb9a21c`
+  * `sourcehut:~misterio/nix-colors/21c1a380a6915d890d408e9f22203436a35bb2de?host=hg.sr.ht`
+
 * `indirect`: Indirections through the flake registry. These have the
   form
 

From 1fd127a06833c19a5a2965bd41cf4f695773cca6 Mon Sep 17 00:00:00 2001
From: "Travis A. Everett" <travis.a.everett@gmail.com>
Date: Fri, 18 Feb 2022 23:15:37 -0600
Subject: [PATCH 03/52] install-darwin: fix mount permission edge-case

Fixes #6122, which reports a problem with trying to run the installer
under another user (probably: user is not the disk "owner" and thus
can't mount the volume).
---
 scripts/create-darwin-volume.sh | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/scripts/create-darwin-volume.sh b/scripts/create-darwin-volume.sh
index bd8a7ee3a..ece4f29bb 100755
--- a/scripts/create-darwin-volume.sh
+++ b/scripts/create-darwin-volume.sh
@@ -685,22 +685,27 @@ encrypt_volume() {
     local volume_uuid="$1"
     local volume_label="$2"
     local password
+
+    task "Encrypt the Nix volume" >&2
+
     # Note: mount/unmount are late additions to support the right order
     # of operations for creating the volume and then baking its uuid into
     # other artifacts; not as well-trod wrt to potential errors, race
     # conditions, etc.
 
-    /usr/sbin/diskutil mount "$volume_label"
+    _sudo "to mount your Nix volume for encrypting" \
+        /usr/sbin/diskutil mount "$volume_label"
 
     password="$(/usr/bin/xxd -l 32 -p -c 256 /dev/random)"
     _sudo "to add your Nix volume's password to Keychain" \
         /usr/bin/security -i <<EOF
 add-generic-password -a "$volume_label" -s "$volume_uuid" -l "$volume_label encryption password" -D "Encrypted volume password" -j "Added automatically by the Nix installer for use by $NIX_VOLUME_MOUNTD_DEST" -w "$password" -T /System/Library/CoreServices/APFSUserAgent -T /System/Library/CoreServices/CSUserAgent -T /usr/bin/security "/Library/Keychains/System.keychain"
 EOF
-    builtin printf "%s" "$password" | _sudo "to encrypt your Nix volume" \
+    builtin printf "%s" "$password" | _sudo "to actually encrypt your Nix volume" \
         /usr/sbin/diskutil apfs encryptVolume "$volume_label" -user disk -stdinpassphrase
 
-    /usr/sbin/diskutil unmount force "$volume_label"
+    _sudo "to unmount the encrypted volume" \
+        /usr/sbin/diskutil unmount force "$volume_label"
 }
 
 create_volume() {

From 61295b910f2f2a6f2b0d288248c946713977ff1e Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sun, 20 Feb 2022 23:46:11 -0600
Subject: [PATCH 04/52] Add verbosity to nix profile upgrade

Followup of https://github.com/NixOS/nix/pull/6086. This time adding a
warning if no packages are upgraded.
---
 src/nix/profile.cc | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index 55b5ff736..f0ce7eba8 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -410,12 +410,16 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
         // FIXME: code duplication
         std::vector<DerivedPath> pathsToBuild;
 
+        auto upgradedCount = 0;
+
         for (size_t i = 0; i < manifest.elements.size(); ++i) {
             auto & element(manifest.elements[i]);
             if (element.source
                 && !element.source->originalRef.input.isImmutable()
                 && matches(*store, element, i, matchers))
             {
+                upgradedCount++;
+
                 Activity act(*logger, lvlChatty, actUnknown,
                     fmt("checking '%s' for updates", element.source->attrPath));
 
@@ -448,6 +452,19 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
             }
         }
 
+        if (upgradedCount == 0) {
+            for (auto matcher: matchers) {
+                if (const size_t* index = std::get_if<size_t>(&matcher)){
+                    warn("'%d' is not a valid index in profile", *index);
+                } else if (const Path* path = std::get_if<Path>(&matcher)){
+                    warn("'%s' does not match any paths in profile", *path);
+                } else if (const RegexPattern* regex = std::get_if<RegexPattern>(&matcher)){
+                    warn("'%s' does not match any packages in profile", regex->pattern);
+                }
+            }
+            warn ("Try `nix profile list` to see the current profile.");
+        }
+
         store->buildPaths(pathsToBuild);
 
         updateProfile(manifest.build(store));

From 3cd958849b820ba6ec80965afa6268f59c9bb650 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Mon, 21 Feb 2022 10:04:04 -0600
Subject: [PATCH 05/52] Apply suggestions from code review

Co-authored-by: Eelco Dolstra <edolstra@gmail.com>
---
 src/nix/profile.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index f0ce7eba8..508cbd336 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -453,7 +453,7 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
         }
 
         if (upgradedCount == 0) {
-            for (auto matcher: matchers) {
+            for (auto & matcher : matchers) {
                 if (const size_t* index = std::get_if<size_t>(&matcher)){
                     warn("'%d' is not a valid index in profile", *index);
                 } else if (const Path* path = std::get_if<Path>(&matcher)){
@@ -462,7 +462,7 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
                     warn("'%s' does not match any packages in profile", regex->pattern);
                 }
             }
-            warn ("Try `nix profile list` to see the current profile.");
+            warn ("Use 'nix profile list' to see the current profile.");
         }
 
         store->buildPaths(pathsToBuild);

From 162fbe31ffe4c2b2d7648e5df2d5a0c9b4a44996 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 11 Feb 2022 18:11:08 +0100
Subject: [PATCH 06/52] Replace defaultBla.$system with bla.$system.default

This also simplifies some InstallableFlake logic and fixes 'nix
bundle' parsing its installable twice.

Fixes #5532.
---
 src/libcmd/installables.cc    |  5 ++++-
 src/nix/bundle.cc             | 11 ++++++-----
 src/nix/develop.cc            |  9 ++++++++-
 src/nix/flake.cc              |  2 +-
 src/nix/run.cc                |  5 ++++-
 tests/flake-bundler.sh        | 26 +++++++++++++------------
 tests/flake-local-settings.sh |  2 +-
 tests/flake-searching.sh      |  6 ++++--
 tests/flakes.sh               | 36 ++++++++++++++++++-----------------
 9 files changed, 61 insertions(+), 41 deletions(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index 644954977..c07e39628 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -158,7 +158,10 @@ SourceExprCommand::SourceExprCommand()
 
 Strings SourceExprCommand::getDefaultFlakeAttrPaths()
 {
-    return {"defaultPackage." + settings.thisSystem.get()};
+    return {
+        "packages." + settings.thisSystem.get() + ".default",
+        "defaultPackage." + settings.thisSystem.get()
+    };
 }
 
 Strings SourceExprCommand::getDefaultFlakeAttrPathPrefixes()
diff --git a/src/nix/bundle.cc b/src/nix/bundle.cc
index c13018328..6b891a6ee 100644
--- a/src/nix/bundle.cc
+++ b/src/nix/bundle.cc
@@ -49,9 +49,11 @@ struct CmdBundle : InstallableCommand
 
     Category category() override { return catSecondary; }
 
+    // FIXME: cut&paste from CmdRun.
     Strings getDefaultFlakeAttrPaths() override
     {
         Strings res{
+            "apps." + settings.thisSystem.get() + ".default",
             "defaultApp." + settings.thisSystem.get()
         };
         for (auto & s : SourceExprCommand::getDefaultFlakeAttrPaths())
@@ -61,10 +63,7 @@ struct CmdBundle : InstallableCommand
 
     Strings getDefaultFlakeAttrPathPrefixes() override
     {
-        Strings res{
-            "apps." + settings.thisSystem.get() + "."
-
-        };
+        Strings res{"apps." + settings.thisSystem.get() + "."};
         for (auto & s : SourceExprCommand::getDefaultFlakeAttrPathPrefixes())
             res.push_back(s);
         return res;
@@ -80,7 +79,9 @@ struct CmdBundle : InstallableCommand
         const flake::LockFlags lockFlags{ .writeLockFile = false };
         InstallableFlake bundler{this,
             evalState, std::move(bundlerFlakeRef), bundlerName,
-            {"defaultBundler." + settings.thisSystem.get()},
+            {"bundlers." + settings.thisSystem.get() + ".default",
+             "defaultBundler." + settings.thisSystem.get()
+            },
             {"bundlers." + settings.thisSystem.get() + "."},
             lockFlags
         };
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index f88f5909c..92e31599a 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -325,8 +325,15 @@ struct Common : InstallableCommand, MixProfile
 
     Strings getDefaultFlakeAttrPaths() override
     {
-        return {"devShell." + settings.thisSystem.get(), "defaultPackage." + settings.thisSystem.get()};
+        Strings paths{
+            "devShells." + settings.thisSystem.get() + ".default",
+            "devShell." + settings.thisSystem.get(),
+        };
+        for (auto & p : SourceExprCommand::getDefaultFlakeAttrPaths())
+            paths.push_back(p);
+        return paths;
     }
+
     Strings getDefaultFlakeAttrPathPrefixes() override
     {
         auto res = SourceExprCommand::getDefaultFlakeAttrPathPrefixes();
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index cd85bcea6..303edb9fe 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -651,7 +651,7 @@ struct CmdFlakeCheck : FlakeCommand
 };
 
 static Strings defaultTemplateAttrPathsPrefixes{"templates."};
-static Strings defaultTemplateAttrPaths = {"defaultTemplate"};
+static Strings defaultTemplateAttrPaths = {"templates.default", "defaultTemplate"};
 
 struct CmdFlakeInitCommon : virtual Args, EvalCommand
 {
diff --git a/src/nix/run.cc b/src/nix/run.cc
index bae64ed39..a67c23bcb 100644
--- a/src/nix/run.cc
+++ b/src/nix/run.cc
@@ -158,7 +158,10 @@ struct CmdRun : InstallableCommand
 
     Strings getDefaultFlakeAttrPaths() override
     {
-        Strings res{"defaultApp." + settings.thisSystem.get()};
+        Strings res{
+            "apps." + settings.thisSystem.get() + ".default",
+            "defaultApp." + settings.thisSystem.get(),
+        };
         for (auto & s : SourceExprCommand::getDefaultFlakeAttrPaths())
             res.push_back(s);
         return res;
diff --git a/tests/flake-bundler.sh b/tests/flake-bundler.sh
index 699920f60..9496b8f92 100644
--- a/tests/flake-bundler.sh
+++ b/tests/flake-bundler.sh
@@ -10,26 +10,28 @@ cd $TEST_HOME
 cat <<EOF > flake.nix
 {
     outputs = {self}: {
-       bundlers.$system.simple = drv:
+      bundlers.$system = rec {
+        simple = drv:
           if drv?type && drv.type == "derivation"
           then drv
-          else self.defaultPackage.$system;
-       defaultBundler.$system = self.bundlers.$system.simple;
-       defaultPackage.$system = import ./simple.nix;
-       defaultApp.$system = {
-         type = "app";
-         program = "\${import ./simple.nix}/hello";
-       };
+          else self.packages.$system.default;
+        default = simple;
+      };
+      packages.$system.default = import ./simple.nix;
+      apps.$system.default = {
+        type = "app";
+        program = "\${import ./simple.nix}/hello";
+      };
     };
 }
 EOF
 nix build .#
 nix bundle --bundler .# .#
-nix bundle --bundler .#defaultBundler.$system  .#defaultPackage.$system
-nix bundle --bundler .#bundlers.$system.simple .#defaultPackage.$system
+nix bundle --bundler .#bundlers.$system.default .#packages.$system.default
+nix bundle --bundler .#bundlers.$system.simple  .#packages.$system.default
 
-nix bundle --bundler .#defaultBundler.$system  .#defaultApp.$system
-nix bundle --bundler .#bundlers.$system.simple .#defaultApp.$system
+nix bundle --bundler .#bundlers.$system.default .#apps.$system.default
+nix bundle --bundler .#bundlers.$system.simple  .#apps.$system.default
 
 clearStore
 
diff --git a/tests/flake-local-settings.sh b/tests/flake-local-settings.sh
index 7765fe379..e92c16f87 100644
--- a/tests/flake-local-settings.sh
+++ b/tests/flake-local-settings.sh
@@ -21,7 +21,7 @@ cat <<EOF > flake.nix
     nixConfig.allow-dirty = false; # See #5621
 
     outputs = a: {
-       defaultPackage.$system = import ./simple.nix;
+       packages.$system.default = import ./simple.nix;
     };
 }
 EOF
diff --git a/tests/flake-searching.sh b/tests/flake-searching.sh
index bc55f2bdc..db241f6d2 100644
--- a/tests/flake-searching.sh
+++ b/tests/flake-searching.sh
@@ -15,8 +15,10 @@ cat <<EOF > flake.nix
 {
     inputs.foo.url = "$PWD/foo";
     outputs = a: {
-       defaultPackage.$system = import ./simple.nix;
-       packages.$system.test = import ./simple.nix;
+       packages.$system = rec {
+         test = import ./simple.nix;
+         default = test;
+       };
     };
 }
 EOF
diff --git a/tests/flakes.sh b/tests/flakes.sh
index db178967f..ea629ae70 100644
--- a/tests/flakes.sh
+++ b/tests/flakes.sh
@@ -41,8 +41,10 @@ cat > $flake1Dir/flake.nix <<EOF
   description = "Bla bla";
 
   outputs = inputs: rec {
-    packages.$system.foo = import ./simple.nix;
-    defaultPackage.$system = packages.$system.foo;
+    packages.$system = rec {
+      foo = import ./simple.nix;
+      default = foo;
+    };
 
     # To test "nix flake init".
     legacyPackages.x86_64-linux.hello = import ./simple.nix;
@@ -128,7 +130,7 @@ hash2=$(nix flake metadata flake1 --json --refresh | jq -r .revision)
 nix build -o $TEST_ROOT/result flake1#foo
 [[ -e $TEST_ROOT/result/hello ]]
 
-# Test defaultPackage.
+# Test packages.default.
 nix build -o $TEST_ROOT/result flake1
 [[ -e $TEST_ROOT/result/hello ]]
 
@@ -140,11 +142,11 @@ nix build -o $flake1Dir/result git+file://$flake1Dir
 nix path-info $flake1Dir/result
 
 # 'getFlake' on a mutable flakeref should fail in pure mode, but succeed in impure mode.
-(! nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"$flake1Dir\").defaultPackage.$system")
-nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"$flake1Dir\").defaultPackage.$system" --impure
+(! nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"$flake1Dir\").packages.$system.default")
+nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"$flake1Dir\").packages.$system.default" --impure
 
 # 'getFlake' on an immutable flakeref should succeed even in pure mode.
-nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"git+file://$flake1Dir?rev=$hash2\").defaultPackage.$system"
+nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"git+file://$flake1Dir?rev=$hash2\").packages.$system.default"
 
 # Building a flake with an unlocked dependency should fail in pure mode.
 (! nix build -o $TEST_ROOT/result flake2#bar --no-registries)
@@ -370,13 +372,13 @@ cat > $templatesDir/flake.nix <<EOF
   description = "Some templates";
 
   outputs = { self }: {
-    templates = {
+    templates = rec {
       trivial = {
         path = ./trivial;
         description = "A trivial flake";
       };
+      default = trivial;
     };
-    defaultTemplate = self.templates.trivial;
   };
 }
 EOF
@@ -388,8 +390,10 @@ cat > $templatesDir/trivial/flake.nix <<EOF
   description = "A flake for building Hello World";
 
   outputs = { self, nixpkgs }: {
-    packages.x86_64-linux.hello = nixpkgs.legacyPackages.x86_64-linux.hello;
-    defaultPackage.x86_64-linux = self.packages.x86_64-linux.hello;
+    packages.x86_64-linux = rec {
+      hello = nixpkgs.legacyPackages.x86_64-linux.hello;
+      default = hello;
+    };
   };
 }
 EOF
@@ -496,17 +500,15 @@ EOF
 cat > $flake3Dir/flake.nix <<EOF
 {
   outputs = { flake1, self }: {
-    defaultPackage = {
-        system-1 = "foo";
-        system-2 = "bar";
-    };
+    packages.system-1.default = "foo";
+    packages.system-2.default = "bar";
   };
 }
 EOF
 
 checkRes=$(nix flake check --keep-going $flake3Dir 2>&1 && fail "nix flake check should have failed" || true)
-echo "$checkRes" | grep -q "defaultPackage.system-1"
-echo "$checkRes" | grep -q "defaultPackage.system-2"
+echo "$checkRes" | grep -q "packages.system-1.default"
+echo "$checkRes" | grep -q "packages.system-2.default"
 
 # Test 'follows' inputs.
 cat > $flake3Dir/flake.nix <<EOF
@@ -591,7 +593,7 @@ mkdir $flake5Dir
 cat > $flake5Dir/flake.nix <<EOF
 {
   outputs = { self, flake1 }: {
-    defaultPackage.$system = flake1.defaultPackage.$system;
+    packages.$system.default = flake1.packages.$system.default;
     expr = assert builtins.pathExists ./flake.lock; 123;
   };
 }

From d4428d00ae05cd21c256f9490c7f089ec04fd962 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Feb 2022 14:19:39 +0100
Subject: [PATCH 07/52] nix flake check: Warn about deprecated flake outputs

---
 src/nix/flake.cc | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 303edb9fe..14a235501 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -501,6 +501,17 @@ struct CmdFlakeCheck : FlakeCommand
 
                         state->forceValue(vOutput, pos);
 
+                        std::string_view replacement =
+                            name == "defaultPackage" ? "packages.<system>.default" :
+                            name == "defaultApps" ? "apps.<system>.default" :
+                            name == "defaultTemplate" ? "templates.default" :
+                            name == "defaultBundler" ? "bundlers.<system>.default" :
+                            name == "overlay" ? "overlays.default" :
+                            name == "devShell" ? "devShells.<system>.default" :
+                            "";
+                        if (replacement != "")
+                            warn("flake output attribute '%s' is deprecated; use '%s' instead", name, replacement);
+
                         if (name == "checks") {
                             state->forceAttrs(vOutput, pos);
                             for (auto & attr : *vOutput.attrs) {

From 38eea2c503a70e32dd6110937d49705976d5fc7a Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Feb 2022 14:23:39 +0100
Subject: [PATCH 08/52] Update release notes

---
 doc/manual/src/release-notes/rl-next.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md
index 80eed9397..7dd8387d8 100644
--- a/doc/manual/src/release-notes/rl-next.md
+++ b/doc/manual/src/release-notes/rl-next.md
@@ -1,5 +1,18 @@
 # Release X.Y (202?-??-??)
 
+* A number of "default" flake output attributes have been
+  renamed. These are:
+
+  * `defaultPackage.<system>` → `packages.<system>.default`
+  * `defaultApps.<system>` → `apps.<system>.default`
+  * `defaultTemplate` → `templates.default`
+  * `defaultBundler.<system>` → `bundlers.<system>.default`
+  * `overlay` → `overlays.default`
+  * `devShell.<system>` → `devShells.<system>.default`
+
+  The old flake output attributes still work, but `nix flake check`
+  will warn about them.
+
 * `nix bundle` breaking API change now supports bundlers of the form
   `bundler.<system>.<name>= derivation: another-derivation;`. This supports
   additional functionality to inspect evaluation information during bundling. A

From 1a6548ca757f81594f5b54d8dada4c5ba65821de Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Feb 2022 14:32:56 +0100
Subject: [PATCH 09/52] Update docs

---
 src/nix/bundle.md       | 14 ++++++++------
 src/nix/develop.md      |  4 ++--
 src/nix/flake-init.md   |  8 ++++----
 src/nix/flake-show.md   | 11 +++++++----
 src/nix/flake.md        |  2 +-
 src/nix/nix.md          |  6 ++----
 src/nix/profile-list.md |  2 +-
 src/nix/profile.md      |  2 +-
 src/nix/run.md          |  6 +++---
 9 files changed, 29 insertions(+), 26 deletions(-)

diff --git a/src/nix/bundle.md b/src/nix/bundle.md
index a5186a996..2bb70711f 100644
--- a/src/nix/bundle.md
+++ b/src/nix/bundle.md
@@ -42,24 +42,26 @@ homepage](https://github.com/NixOS/bundlers) for more details.
 If no flake output attribute is given, `nix bundle` tries the following
 flake output attributes:
 
-* `defaultBundler.<system>`
+* `bundlers.<system>.default`
 
 If an attribute *name* is given, `nix run` tries the following flake
 output attributes:
 
-* `bundler.<system>.<name>`
+* `bundlers.<system>.<name>`
 
 # Bundlers
 
 A bundler is specified by a flake output attribute named
-`bundlers.<system>.<name>` or `defaultBundler.<system>`. It looks like this:
+`bundlers.<system>.<name>`. It looks like this:
 
 ```nix
-bundlers.x86_64-linux.identity = drv: drv;
+bundlers.x86_64-linux = rec {
+  identity = drv: drv;
 
-bundlers.x86_64-linux.blender_2_79 = drv: self.packages.x86_64-linux.blender_2_79;
+  blender_2_79 = drv: self.packages.x86_64-linux.blender_2_79;
 
-defaultBundler.x86_64-linux = drv: drv;
+  default = identity;
+};
 ```
 
 A bundler must be a function that accepts an arbitrary value (typically a
diff --git a/src/nix/develop.md b/src/nix/develop.md
index 3e7e339d5..8bcff66c9 100644
--- a/src/nix/develop.md
+++ b/src/nix/develop.md
@@ -88,9 +88,9 @@ the flake's `nixConfig` attribute.
 If no flake output attribute is given, `nix develop` tries the following
 flake output attributes:
 
-* `devShell.<system>`
+* `devShells.<system>.default`
 
-* `defaultPackage.<system>`
+* `packages.<system>.default`
 
 If a flake output *name* is given, `nix develop` tries the following flake
 output attributes:
diff --git a/src/nix/flake-init.md b/src/nix/flake-init.md
index c13b22248..fc1f4f805 100644
--- a/src/nix/flake-init.md
+++ b/src/nix/flake-init.md
@@ -24,13 +24,13 @@ R""(
 
 This command creates a flake in the current directory by copying the
 files of a template. It will not overwrite existing files. The default
-template is `templates#defaultTemplate`, but this can be overridden
+template is `templates#templates.default`, but this can be overridden
 using `-t`.
 
 # Template definitions
 
-A flake can declare templates through its `templates` and
-`defaultTemplate` output attributes. A template has two attributes:
+A flake can declare templates through its `templates` output
+attribute. A template has two attributes:
 
 * `description`: A one-line description of the template, in CommonMark
   syntax.
@@ -61,7 +61,7 @@ outputs = { self }: {
     '';
   };
 
-  templates.defaultTemplate = self.templates.rust;
+  templates.default = self.templates.rust;
 }
 ```
 
diff --git a/src/nix/flake-show.md b/src/nix/flake-show.md
index e484cf47e..f3b74285d 100644
--- a/src/nix/flake-show.md
+++ b/src/nix/flake-show.md
@@ -13,10 +13,13 @@ R""(
   │   │   └───build: derivation 'patchelf-0.12.20201207.f34751b'
   │   └───x86_64-linux
   │       └───build: derivation 'patchelf-0.12.20201207.f34751b'
-  ├───defaultPackage
-  │   ├───aarch64-linux: package 'patchelf-0.12.20201207.f34751b'
-  │   ├───i686-linux: package 'patchelf-0.12.20201207.f34751b'
-  │   └───x86_64-linux: package 'patchelf-0.12.20201207.f34751b'
+  ├───packages
+  │   ├───aarch64-linux
+  │   │   └───default: package 'patchelf-0.12.20201207.f34751b'
+  │   ├───i686-linux
+  │   │   └───default: package 'patchelf-0.12.20201207.f34751b'
+  │   └───x86_64-linux
+  │       └───default: package 'patchelf-0.12.20201207.f34751b'
   ├───hydraJobs
   │   ├───build
   │   │   ├───aarch64-linux: derivation 'patchelf-0.12.20201207.f34751b'
diff --git a/src/nix/flake.md b/src/nix/flake.md
index accddd436..48c12d30f 100644
--- a/src/nix/flake.md
+++ b/src/nix/flake.md
@@ -236,7 +236,7 @@ derivation):
 
   outputs = { self, nixpkgs }: {
 
-    defaultPackage.x86_64-linux =
+    packages.x86_64-linux.default =
       # Notice the reference to nixpkgs here.
       with import nixpkgs { system = "x86_64-linux"; };
       stdenv.mkDerivation {
diff --git a/src/nix/nix.md b/src/nix/nix.md
index 1dc59362d..0dacadee6 100644
--- a/src/nix/nix.md
+++ b/src/nix/nix.md
@@ -97,11 +97,9 @@ the Nix store. Here are the recognised types of installables:
     For example, if `/foo/bar/flake.nix` exists, then `/foo/bar/baz/` will resolve to
    `path:/foo/bar`
 
-
-
   If *attrpath* is omitted, Nix tries some default values; for most
-  subcommands, the default is `defaultPackage.`*system*
-  (e.g. `defaultPackage.x86_64-linux`), but some subcommands have
+  subcommands, the default is `packages.`*system*`.default`
+  (e.g. `packages.x86_64-linux.default`), but some subcommands have
   other defaults. If *attrpath* *is* specified, *attrpath* is
   interpreted as relative to one or more prefixes; for most
   subcommands, these are `packages.`*system*,
diff --git a/src/nix/profile-list.md b/src/nix/profile-list.md
index 5c29c0b02..bdab9a208 100644
--- a/src/nix/profile-list.md
+++ b/src/nix/profile-list.md
@@ -8,7 +8,7 @@ R""(
   # nix profile list
   0 flake:nixpkgs#legacyPackages.x86_64-linux.spotify github:NixOS/nixpkgs/c23db78bbd474c4d0c5c3c551877523b4a50db06#legacyPackages.x86_64-linux.spotify /nix/store/akpdsid105phbbvknjsdh7hl4v3fhjkr-spotify-1.1.46.916.g416cacf1
   1 flake:nixpkgs#legacyPackages.x86_64-linux.zoom-us github:NixOS/nixpkgs/c23db78bbd474c4d0c5c3c551877523b4a50db06#legacyPackages.x86_64-linux.zoom-us /nix/store/89pmjmbih5qpi7accgacd17ybpgp4xfm-zoom-us-5.4.53350.1027
-  2 flake:blender-bin#defaultPackage.x86_64-linux github:edolstra/nix-warez/d09d7eea893dcb162e89bc67f6dc1ced14abfc27?dir=blender#defaultPackage.x86_64-linux /nix/store/zfgralhqjnam662kqsgq6isjw8lhrflz-blender-bin-2.91.0
+  2 flake:blender-bin#packages.x86_64-linux.default github:edolstra/nix-warez/d09d7eea893dcb162e89bc67f6dc1ced14abfc27?dir=blender#packages.x86_64-linux.default /nix/store/zfgralhqjnam662kqsgq6isjw8lhrflz-blender-bin-2.91.0
   ```
 
 # Description
diff --git a/src/nix/profile.md b/src/nix/profile.md
index d3ddcd3d1..0a4ff2fa9 100644
--- a/src/nix/profile.md
+++ b/src/nix/profile.md
@@ -96,7 +96,7 @@ has the following fields:
   user specified, but the one resulting from applying the default
   attribute paths and prefixes; for instance, `hello` might resolve to
   `packages.x86_64-linux.hello` and the empty string to
-  `defaultPackage.x86_64-linux`.
+  `packages.x86_64-linux.default`.
 
 * `storePath`: The paths in the Nix store containing the package.
 
diff --git a/src/nix/run.md b/src/nix/run.md
index cd3b978c0..a0f362076 100644
--- a/src/nix/run.md
+++ b/src/nix/run.md
@@ -58,9 +58,9 @@ For instance, if `name` is set to `hello-1.10`, `nix run` will run
 If no flake output attribute is given, `nix run` tries the following
 flake output attributes:
 
-* `defaultApp.<system>`
+* `apps.<system>.default`
 
-* `defaultPackage.<system>`
+* `packages.<system>.default`
 
 If an attribute *name* is given, `nix run` tries the following flake
 output attributes:
@@ -74,7 +74,7 @@ output attributes:
 # Apps
 
 An app is specified by a flake output attribute named
-`apps.<system>.<name>` or `defaultApp.<system>`. It looks like this:
+`apps.<system>.<name>`. It looks like this:
 
 ```nix
 apps.x86_64-linux.blender_2_79 = {

From ba9a8c4b3d0f8f008a2067e26e89d6165d14c814 Mon Sep 17 00:00:00 2001
From: "Travis A. Everett" <travis.a.everett@gmail.com>
Date: Tue, 22 Feb 2022 12:44:15 -0600
Subject: [PATCH 10/52] install-darwin: track mount permission edge-case fix

Same as 1fd127a06833c19a5a2965bd41cf4f695773cca6, but applied to a
code path (volume_pass_works -> verify_volume_pass) that the reporting
user didn't hit and wasn't able to trigger manually. I am not certain
but I suspect it will be easier to add prophylactically than to debug
if its absence causes trouble some day.
---
 scripts/create-darwin-volume.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/create-darwin-volume.sh b/scripts/create-darwin-volume.sh
index ece4f29bb..4bac4b7ba 100755
--- a/scripts/create-darwin-volume.sh
+++ b/scripts/create-darwin-volume.sh
@@ -246,7 +246,8 @@ get_volume_pass() {
 verify_volume_pass() {
     local volume_special="$1" # (i.e., disk1s7)
     local volume_uuid="$2"
-    /usr/sbin/diskutil apfs unlockVolume "$volume_special" -verify -stdinpassphrase -user "$volume_uuid"
+    _sudo "to confirm the password actually unlocks the volume" \
+        /usr/sbin/diskutil apfs unlockVolume "$volume_special" -verify -stdinpassphrase -user "$volume_uuid"
 }
 
 volume_pass_works() {

From 54f07b66c87fd749f7ecfaeb89d878557b625d78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?=
 <7226587+thufschmitt@users.noreply.github.com>
Date: Wed, 23 Feb 2022 09:17:08 +0100
Subject: [PATCH 11/52] Precise the doc for `--include-outputs`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Make it explicit that it only includes the existing outputs and not the ones that haven’t been realised
---
 doc/manual/src/command-ref/nix-store.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/manual/src/command-ref/nix-store.md b/doc/manual/src/command-ref/nix-store.md
index 26292f1bb..7db9f0c1c 100644
--- a/doc/manual/src/command-ref/nix-store.md
+++ b/doc/manual/src/command-ref/nix-store.md
@@ -321,8 +321,8 @@ symlink.
     This query has one option:
 
       - `--include-outputs`
-        Also include the output path of store derivations, and their
-        closures.
+        Also include the existing output paths of store derivations,
+        and their closures.
 
     This query can be used to implement various kinds of deployment. A
     *source deployment* is obtained by distributing the closure of a

From 2cc645a91a07458fd23e0aacd6ccdf63cad199b9 Mon Sep 17 00:00:00 2001
From: Guillaume Desforges <guillaume.desforges.pro@gmail.com>
Date: Wed, 23 Feb 2022 15:06:13 +0100
Subject: [PATCH 12/52] Add html make target

---
 doc/manual/local.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/manual/local.mk b/doc/manual/local.mk
index 6b232a736..c1ce8aaeb 100644
--- a/doc/manual/local.mk
+++ b/doc/manual/local.mk
@@ -72,6 +72,7 @@ $(d)/builtins.json: $(bindir)/nix
 	@mv $@.tmp $@
 
 # Generate the HTML manual.
+html: $(docdir)/manual/index.html
 install: $(docdir)/manual/index.html
 
 # Generate 'nix' manpages.

From 6462ee61c7c6ea7a93c01c89bf311fe8f454f35f Mon Sep 17 00:00:00 2001
From: Guillaume Desforges <guillaume.desforges.pro@gmail.com>
Date: Wed, 23 Feb 2022 15:07:01 +0100
Subject: [PATCH 13/52] Anchor link for builtin functions in HTML doc

---
 doc/manual/generate-builtins.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/manual/generate-builtins.nix b/doc/manual/generate-builtins.nix
index 92c7b1a31..b481beecd 100644
--- a/doc/manual/generate-builtins.nix
+++ b/doc/manual/generate-builtins.nix
@@ -6,9 +6,9 @@ builtins:
 concatStrings (map
   (name:
     let builtin = builtins.${name}; in
-    "<dt><code>${name} "
+    "<dt id=\"${name}\"><a href=\"#${name}\"><code>${name} "
     + concatStringsSep " " (map (s: "<var>${s}</var>") builtin.args)
-    + "</code></dt>"
+    + "</code></a></dt>"
     + "<dd>\n\n"
     + builtin.doc
     + "\n\n</dd>"

From 770f3af31df552c47ac6bc38d386d10f8ff1c856 Mon Sep 17 00:00:00 2001
From: Gabriel Fontes <eu@misterio.me>
Date: Wed, 23 Feb 2022 11:58:09 -0300
Subject: [PATCH 14/52] add sourcehut integration test

---
 flake.nix                  |   6 ++
 tests/sourcehut-flakes.nix | 156 +++++++++++++++++++++++++++++++++++++
 2 files changed, 162 insertions(+)
 create mode 100644 tests/sourcehut-flakes.nix

diff --git a/flake.nix b/flake.nix
index ae9305144..87b00edf4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -501,6 +501,12 @@
           inherit (self) overlay;
         });
 
+        tests.sourcehutFlakes = (import ./tests/sourcehut-flakes.nix rec {
+          system = "x86_64-linux";
+          inherit nixpkgs;
+          inherit (self) overlay;
+        });
+
         tests.setuid = nixpkgs.lib.genAttrs
           ["i686-linux" "x86_64-linux"]
           (system:
diff --git a/tests/sourcehut-flakes.nix b/tests/sourcehut-flakes.nix
new file mode 100644
index 000000000..d1d89d149
--- /dev/null
+++ b/tests/sourcehut-flakes.nix
@@ -0,0 +1,156 @@
+{ nixpkgs, system, overlay }:
+
+with import (nixpkgs + "/nixos/lib/testing-python.nix")
+{
+  inherit system;
+  extraConfigurations = [{ nixpkgs.overlays = [ overlay ]; }];
+};
+
+let
+  # Generate a fake root CA and a fake git.sr.ht certificate.
+  cert = pkgs.runCommand "cert" { buildInputs = [ pkgs.openssl ]; }
+    ''
+      mkdir -p $out
+
+      openssl genrsa -out ca.key 2048
+      openssl req -new -x509 -days 36500 -key ca.key \
+        -subj "/C=NL/ST=Denial/L=Springfield/O=Dis/CN=Root CA" -out $out/ca.crt
+
+      openssl req -newkey rsa:2048 -nodes -keyout $out/server.key \
+        -subj "/C=CN/ST=Denial/L=Springfield/O=Dis/CN=git.sr.ht" -out server.csr
+      openssl x509 -req -extfile <(printf "subjectAltName=DNS:git.sr.ht") \
+        -days 36500 -in server.csr -CA $out/ca.crt -CAkey ca.key -CAcreateserial -out $out/server.crt
+    '';
+
+  registry = pkgs.writeTextFile {
+    name = "registry";
+    text = ''
+      {
+        "flakes": [
+          {
+            "from": {
+              "type": "indirect",
+              "id": "nixpkgs"
+            },
+            "to": {
+              "type": "sourcehut",
+              "owner": "~NixOS",
+              "repo": "nixpkgs"
+            }
+          }
+        ],
+        "version": 2
+      }
+    '';
+    destination = "/flake-registry.json";
+  };
+
+  nixpkgs-repo = pkgs.runCommand "nixpkgs-flake" { }
+    ''
+      dir=NixOS-nixpkgs-${nixpkgs.shortRev}
+      cp -prd ${nixpkgs} $dir
+
+      # Set the correct timestamp in the tarball.
+      find $dir -print0 | xargs -0 touch -t ${builtins.substring 0 12 nixpkgs.lastModifiedDate}.${builtins.substring 12 2 nixpkgs.lastModifiedDate} --
+
+      mkdir -p $out/archive
+      tar cfz $out/archive/${nixpkgs.rev}.tar.gz $dir --hard-dereference
+
+      echo 'ref: refs/heads/master' > $out/HEAD
+
+      mkdir -p $out/info
+      echo '${nixpkgs.rev} refs/heads/master' > $out/info/refs
+    '';
+
+in
+
+makeTest (
+
+  {
+    name = "sourcehut-flakes";
+
+    nodes =
+      {
+        # Impersonate git.sr.ht
+        sourcehut =
+          { config, pkgs, ... }:
+          {
+            networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+            services.httpd.enable = true;
+            services.httpd.adminAddr = "foo@example.org";
+            services.httpd.extraConfig = ''
+              ErrorLog syslog:local6
+            '';
+            services.httpd.virtualHosts."git.sr.ht" =
+              {
+                forceSSL = true;
+                sslServerKey = "${cert}/server.key";
+                sslServerCert = "${cert}/server.crt";
+                servedDirs =
+                  [
+                    {
+                      urlPath = "/~NixOS/nixpkgs";
+                      dir = nixpkgs-repo;
+                    }
+                    {
+                      urlPath = "/~NixOS/flake-registry/blob/master";
+                      dir = registry;
+                    }
+                  ];
+              };
+          };
+
+        client =
+          { config, lib, pkgs, nodes, ... }:
+          {
+            virtualisation.writableStore = true;
+            virtualisation.diskSize = 2048;
+            virtualisation.pathsInNixDB = [ pkgs.hello pkgs.fuse ];
+            virtualisation.memorySize = 4096;
+            nix.binaryCaches = lib.mkForce [ ];
+            nix.extraOptions = ''
+              experimental-features = nix-command flakes
+              flake-registry = https://git.sr.ht/~NixOS/flake-registry/blob/master/flake-registry.json
+            '';
+            environment.systemPackages = [ pkgs.jq ];
+            networking.hosts.${(builtins.head nodes.sourcehut.config.networking.interfaces.eth1.ipv4.addresses).address} =
+              [ "git.sr.ht" ];
+            security.pki.certificateFiles = [ "${cert}/ca.crt" ];
+          };
+      };
+
+    testScript = { nodes }: ''
+      # fmt: off
+      import json
+      import time
+
+      start_all()
+
+      sourcehut.wait_for_unit("httpd.service")
+
+      client.succeed("curl -v https://git.sr.ht/ >&2")
+      client.succeed("nix registry list | grep nixpkgs")
+
+      rev = client.succeed("nix flake info nixpkgs --json | jq -r .revision")
+      assert rev.strip() == "${nixpkgs.rev}", "revision mismatch"
+
+      client.succeed("nix registry pin nixpkgs")
+
+      client.succeed("nix flake info nixpkgs --tarball-ttl 0 >&2")
+
+      # Shut down the web server. The flake should be cached on the client.
+      sourcehut.succeed("systemctl stop httpd.service")
+
+      info = json.loads(client.succeed("nix flake info nixpkgs --json"))
+      date = time.strftime("%Y%m%d%H%M%S", time.gmtime(info['lastModified']))
+      assert date == "${nixpkgs.lastModifiedDate}", "time mismatch"
+
+      client.succeed("nix build nixpkgs#hello")
+
+      # The build shouldn't fail even with --tarball-ttl 0 (the server
+      # being down should not be a fatal error).
+      client.succeed("nix build nixpkgs#fuse --tarball-ttl 0")
+    '';
+
+  })

From cfbf9ee2ce35b64ced1822c132bd46bd4fd848b2 Mon Sep 17 00:00:00 2001
From: Guillaume Desforges <guillaume.desforges.pro@gmail.com>
Date: Thu, 24 Feb 2022 13:50:50 +0100
Subject: [PATCH 15/52] Anchor with prefix

---
 doc/manual/generate-builtins.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/manual/generate-builtins.nix b/doc/manual/generate-builtins.nix
index b481beecd..6c8b88da2 100644
--- a/doc/manual/generate-builtins.nix
+++ b/doc/manual/generate-builtins.nix
@@ -6,7 +6,7 @@ builtins:
 concatStrings (map
   (name:
     let builtin = builtins.${name}; in
-    "<dt id=\"${name}\"><a href=\"#${name}\"><code>${name} "
+    "<dt id=\"builtins-${name}\"><a href=\"#builtins-${name}\"><code>${name} "
     + concatStringsSep " " (map (s: "<var>${s}</var>") builtin.args)
     + "</code></a></dt>"
     + "<dd>\n\n"

From 42766f89246ded45d80bdf62061cbafc42540c54 Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Thu, 24 Feb 2022 14:15:27 +0100
Subject: [PATCH 16/52] Sort the tests by wall time

The tests are scheduled in the order they appear, so running the long
ones first slightly improves the scheduling.

On my machine, this decreases the time of `make install` from 40s to 36s
---
 tests/local.mk | 124 ++++++++++++++++++++++++++++++-------------------
 1 file changed, 75 insertions(+), 49 deletions(-)

diff --git a/tests/local.mk b/tests/local.mk
index 47717fa67..53a9179a3 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -1,72 +1,98 @@
 nix_tests = \
-  hash.sh lang.sh add.sh simple.sh dependencies.sh \
-  config.sh \
-  gc.sh \
+  flakes.sh \
   ca/gc.sh \
-  gc-concurrent.sh \
-  gc-non-blocking.sh \
+  gc.sh \
+  remote-store.sh \
+  lang.sh \
+  fetchMercurial.sh \
   gc-auto.sh \
-  referrers.sh user-envs.sh logging.sh nix-build.sh misc.sh fixed.sh \
-  gc-runtime.sh check-refs.sh filter-source.sh \
-  local-store.sh remote-store.sh export.sh export-graph.sh \
-  db-migration.sh \
-  timeout.sh secure-drv-outputs.sh nix-channel.sh \
-  multiple-outputs.sh import-derivation.sh ca/import-derivation.sh fetchurl.sh optimise-store.sh \
+  user-envs.sh \
   binary-cache.sh \
+  multiple-outputs.sh \
+  ca/build.sh \
+  nix-build.sh \
+  gc-concurrent.sh \
+  repair.sh \
+  fixed.sh \
+  export-graph.sh \
+  timeout.sh \
+  fetchGitRefs.sh \
+  gc-runtime.sh \
+  tarball.sh \
+  fetchGit.sh \
+  fetchurl.sh \
+  simple.sh \
+  referrers.sh \
+  optimise-store.sh \
   substitute-with-invalid-ca.sh \
-  binary-cache-build-remote.sh \
-  nix-profile.sh repair.sh dump-db.sh case-hack.sh \
-  check-reqs.sh pass-as-file.sh tarball.sh restricted.sh \
-  placeholders.sh nix-shell.sh \
-  linux-sandbox.sh \
-  build-dry.sh \
+  ca/concurrent-builds.sh \
+  signing.sh \
+  ca/build-with-garbage-path.sh \
+  hash.sh \
+  gc-non-blocking.sh \
+  check.sh \
+  ca/substitute.sh \
+  nix-shell.sh \
+  ca/signatures.sh \
+  ca/nix-shell.sh \
+  ca/nix-copy.sh \
+  check-refs.sh \
   build-remote-input-addressed.sh \
+  secure-drv-outputs.sh \
+  restricted.sh \
+  fetchGitSubmodules.sh \
+  flake-searching.sh \
+  ca/duplicate-realisation-in-closure.sh \
+  readfile-context.sh \
+  nix-channel.sh \
+  recursive.sh \
+  dependencies.sh \
+  check-reqs.sh \
   build-remote-content-addressed-fixed.sh \
   build-remote-content-addressed-floating.sh \
-  ssh-relay.sh \
   nar-access.sh \
+  pure-eval.sh \
+  ca/post-hook.sh \
+  repl.sh \
+  ca/repl.sh \
+  ca/recursive.sh \
+  binary-cache-build-remote.sh \
+  search.sh \
+  logging.sh \
+  export.sh \
+  config.sh \
+  add.sh \
+  local-store.sh \
+  filter-source.sh \
+  misc.sh \
+  dump-db.sh \
+  linux-sandbox.sh \
+  build-dry.sh \
   structured-attrs.sh \
-  fetchGit.sh \
-  fetchGitRefs.sh \
-  fetchGitSubmodules.sh \
-  fetchMercurial.sh \
-  signing.sh \
   shell.sh \
   brotli.sh \
   zstd.sh \
   compression-levels.sh \
-  pure-eval.sh \
-  check.sh \
-  plugins.sh \
-  search.sh \
   nix-copy-ssh.sh \
   post-hook.sh \
-  ca/post-hook.sh \
   function-trace.sh \
-  recursive.sh \
-  describe-stores.sh \
-  flakes.sh \
   flake-local-settings.sh \
-  flake-searching.sh \
-  flake-bundler.sh \
-  build.sh \
-  repl.sh ca/repl.sh \
-  ca/build.sh \
-  ca/build-with-garbage-path.sh \
-  ca/duplicate-realisation-in-closure.sh \
-  ca/substitute.sh \
-  ca/signatures.sh \
-  ca/nix-shell.sh \
-  ca/nix-run.sh \
-  ca/recursive.sh \
-  ca/concurrent-builds.sh \
-  ca/nix-copy.sh \
   eval-store.sh \
-  readfile-context.sh \
-  store-ping.sh \
+  why-depends.sh \
+  import-derivation.sh \
+  ca/import-derivation.sh \
   nix_path.sh \
-  why-depends.sh
-  # parallel.sh
+  case-hack.sh \
+  placeholders.sh \
+  ssh-relay.sh \
+  plugins.sh \
+  build.sh \
+  ca/nix-run.sh \
+  db-migration.sh \
+  nix-profile.sh \
+  pass-as-file.sh \
+  describe-stores.sh \
+  store-ping.sh
 
 ifeq ($(HAVE_LIBCPUID), 1)
 	nix_tests += compute-levels.sh

From 9c470cb9694408078fa2c289b9b776820e611923 Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Thu, 24 Feb 2022 14:57:27 +0100
Subject: [PATCH 17/52] testS: poll more eagerly for the daemon start/stop

Polling every 1 second means that even the simplest test takes at least
2 seconds. We can reasonably poll 1/10 of that to make things much
  quicker (esp. given that most of the time 0.1s is enough for the
  daemon to be started or stopped)
---
 tests/common.sh.in | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/common.sh.in b/tests/common.sh.in
index 61abab1d7..49068f1c3 100644
--- a/tests/common.sh.in
+++ b/tests/common.sh.in
@@ -91,9 +91,9 @@ startDaemon() {
     # ‘nix-daemon’ should have an option to fork into the background.
     rm -f $NIX_DAEMON_SOCKET_PATH
     PATH=$DAEMON_PATH nix daemon &
-    for ((i = 0; i < 30; i++)); do
+    for ((i = 0; i < 300; i++)); do
         if [[ -S $NIX_DAEMON_SOCKET_PATH ]]; then break; fi
-        sleep 1
+        sleep 0.1
     done
     pidDaemon=$!
     trap "killDaemon" EXIT
@@ -102,9 +102,9 @@ startDaemon() {
 
 killDaemon() {
     kill $pidDaemon
-    for i in {0.10}; do
+    for i in {0..100}; do
         kill -0 $pidDaemon || break
-        sleep 1
+        sleep 0.1
     done
     kill -9 $pidDaemon || true
     wait $pidDaemon || true

From 8518cebfceb36f3744c276cc8dbf432b1275f53f Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 24 Feb 2022 18:09:00 +0100
Subject: [PATCH 18/52] libfetchers: Rename immutable -> locked

This is more consistent with flake terminology.
---
 src/libexpr/flake/flake.cc       |  8 ++++----
 src/libexpr/flake/lockfile.cc    |  4 ++--
 src/libexpr/primops/fetchTree.cc |  6 +++---
 src/libfetchers/cache.cc         |  8 ++++----
 src/libfetchers/cache.hh         |  2 +-
 src/libfetchers/fetchers.cc      |  8 ++++----
 src/libfetchers/fetchers.hh      | 12 +++++++-----
 src/libfetchers/git.cc           | 14 +++++++-------
 src/libfetchers/github.cc        |  6 +++---
 src/libfetchers/mercurial.cc     | 14 +++++++-------
 src/libfetchers/tarball.cc       | 14 +++++++-------
 src/nix/profile.cc               |  2 +-
 src/nix/repl.cc                  |  4 ++--
 13 files changed, 52 insertions(+), 50 deletions(-)

diff --git a/src/libexpr/flake/flake.cc b/src/libexpr/flake/flake.cc
index 9f3b58909..6e3fa41f7 100644
--- a/src/libexpr/flake/flake.cc
+++ b/src/libexpr/flake/flake.cc
@@ -501,7 +501,7 @@ LockedFlake lockFlake(
                            this input. */
                         debug("creating new input '%s'", inputPathS);
 
-                        if (!lockFlags.allowMutable && !input.ref->input.isImmutable())
+                        if (!lockFlags.allowMutable && !input.ref->input.isLocked())
                             throw Error("cannot update flake input '%s' in pure mode", inputPathS);
 
                         if (input.isFlake) {
@@ -650,7 +650,7 @@ LockedFlake lockFlake(
                            now. Corner case: we could have reverted from a
                            dirty to a clean tree! */
                         if (flake.lockedRef.input == prevLockedRef.input
-                            && !flake.lockedRef.input.isImmutable())
+                            && !flake.lockedRef.input.isLocked())
                             throw Error("'%s' did not change after I updated its 'flake.lock' file; is 'flake.lock' under version control?", flake.originalRef);
                     }
                 } else
@@ -709,8 +709,8 @@ static void prim_getFlake(EvalState & state, const Pos & pos, Value * * args, Va
 
     string flakeRefS(state.forceStringNoCtx(*args[0], pos));
     auto flakeRef = parseFlakeRef(flakeRefS, {}, true);
-    if (evalSettings.pureEval && !flakeRef.input.isImmutable())
-        throw Error("cannot call 'getFlake' on mutable flake reference '%s', at %s (use --impure to override)", flakeRefS, pos);
+    if (evalSettings.pureEval && !flakeRef.input.isLocked())
+        throw Error("cannot call 'getFlake' on unlocked flake reference '%s', at %s (use --impure to override)", flakeRefS, pos);
 
     callFlake(state,
         lockFlake(state, flakeRef,
diff --git a/src/libexpr/flake/lockfile.cc b/src/libexpr/flake/lockfile.cc
index fda340789..60b52d578 100644
--- a/src/libexpr/flake/lockfile.cc
+++ b/src/libexpr/flake/lockfile.cc
@@ -35,7 +35,7 @@ LockedNode::LockedNode(const nlohmann::json & json)
     , originalRef(getFlakeRef(json, "original", nullptr))
     , isFlake(json.find("flake") != json.end() ? (bool) json["flake"] : true)
 {
-    if (!lockedRef.input.isImmutable())
+    if (!lockedRef.input.isLocked())
         throw Error("lockfile contains mutable lock '%s'",
             fetchers::attrsToJSON(lockedRef.input.toAttrs()));
 }
@@ -220,7 +220,7 @@ bool LockFile::isImmutable() const
     for (auto & i : nodes) {
         if (i == root) continue;
         auto lockedNode = std::dynamic_pointer_cast<const LockedNode>(i);
-        if (lockedNode && !lockedNode->lockedRef.input.isImmutable()) return false;
+        if (lockedNode && !lockedNode->lockedRef.input.isLocked()) return false;
     }
 
     return true;
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index d09e2d9e1..7496104b6 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -19,7 +19,7 @@ void emitTreeAttrs(
     bool emptyRevFallback,
     bool forceDirty)
 {
-    assert(input.isImmutable());
+    assert(input.isLocked());
 
     auto attrs = state.buildBindings(8);
 
@@ -166,8 +166,8 @@ static void fetchTree(
     if (!evalSettings.pureEval && !input.isDirect())
         input = lookupInRegistries(state.store, input).first;
 
-    if (evalSettings.pureEval && !input.isImmutable())
-        throw Error("in pure evaluation mode, 'fetchTree' requires an immutable input, at %s", pos);
+    if (evalSettings.pureEval && !input.isLocked())
+        throw Error("in pure evaluation mode, 'fetchTree' requires a locked input, at %s", pos);
 
     auto [tree, input2] = input.fetch(state.store);
 
diff --git a/src/libfetchers/cache.cc b/src/libfetchers/cache.cc
index 34ff6f85b..0c8ecac9d 100644
--- a/src/libfetchers/cache.cc
+++ b/src/libfetchers/cache.cc
@@ -52,13 +52,13 @@ struct CacheImpl : Cache
         const Attrs & inAttrs,
         const Attrs & infoAttrs,
         const StorePath & storePath,
-        bool immutable) override
+        bool locked) override
     {
         _state.lock()->add.use()
             (attrsToJSON(inAttrs).dump())
             (attrsToJSON(infoAttrs).dump())
             (store->printStorePath(storePath))
-            (immutable)
+            (locked)
             (time(0)).exec();
     }
 
@@ -91,7 +91,7 @@ struct CacheImpl : Cache
 
         auto infoJSON = stmt.getStr(0);
         auto storePath = store->parseStorePath(stmt.getStr(1));
-        auto immutable = stmt.getInt(2) != 0;
+        auto locked = stmt.getInt(2) != 0;
         auto timestamp = stmt.getInt(3);
 
         store->addTempRoot(storePath);
@@ -105,7 +105,7 @@ struct CacheImpl : Cache
             inAttrsJSON, infoJSON, store->printStorePath(storePath));
 
         return Result {
-            .expired = !immutable && (settings.tarballTtl.get() == 0 || timestamp + settings.tarballTtl < time(0)),
+            .expired = !locked && (settings.tarballTtl.get() == 0 || timestamp + settings.tarballTtl < time(0)),
             .infoAttrs = jsonToAttrs(nlohmann::json::parse(infoJSON)),
             .storePath = std::move(storePath)
         };
diff --git a/src/libfetchers/cache.hh b/src/libfetchers/cache.hh
index 3db4f081c..3763ee2a6 100644
--- a/src/libfetchers/cache.hh
+++ b/src/libfetchers/cache.hh
@@ -13,7 +13,7 @@ struct Cache
         const Attrs & inAttrs,
         const Attrs & infoAttrs,
         const StorePath & storePath,
-        bool immutable) = 0;
+        bool locked) = 0;
 
     virtual std::optional<std::pair<Attrs, StorePath>> lookup(
         ref<Store> store,
diff --git a/src/libfetchers/fetchers.cc b/src/libfetchers/fetchers.cc
index c06ccb929..976f40d3b 100644
--- a/src/libfetchers/fetchers.cc
+++ b/src/libfetchers/fetchers.cc
@@ -24,11 +24,11 @@ static void fixupInput(Input & input)
     input.getType();
     input.getRef();
     if (input.getRev())
-        input.immutable = true;
+        input.locked = true;
     input.getRevCount();
     input.getLastModified();
     if (input.getNarHash())
-        input.immutable = true;
+        input.locked = true;
 }
 
 Input Input::fromURL(const ParsedURL & url)
@@ -165,7 +165,7 @@ std::pair<Tree, Input> Input::fetch(ref<Store> store) const
                 input.to_string(), *prevRevCount);
     }
 
-    input.immutable = true;
+    input.locked = true;
 
     assert(input.hasAllInfo());
 
@@ -209,7 +209,7 @@ StorePath Input::computeStorePath(Store & store) const
 {
     auto narHash = getNarHash();
     if (!narHash)
-        throw Error("cannot compute store path for mutable input '%s'", to_string());
+        throw Error("cannot compute store path for unlocked input '%s'", to_string());
     return store.makeFixedOutputPath(FileIngestionMethod::Recursive, *narHash, getName());
 }
 
diff --git a/src/libfetchers/fetchers.hh b/src/libfetchers/fetchers.hh
index 2836af5fa..bc9a76b0b 100644
--- a/src/libfetchers/fetchers.hh
+++ b/src/libfetchers/fetchers.hh
@@ -34,7 +34,7 @@ struct Input
 
     std::shared_ptr<InputScheme> scheme; // note: can be null
     Attrs attrs;
-    bool immutable = false;
+    bool locked = false;
     bool direct = true;
 
     /* path of the parent of this input, used for relative path resolution */
@@ -59,9 +59,9 @@ public:
        one that goes through a registry. */
     bool isDirect() const { return direct; }
 
-    /* Check whether this is an "immutable" input, that is,
+    /* Check whether this is a "locked" input, that is,
        one that contains a commit hash or content hash. */
-    bool isImmutable() const { return immutable; }
+    bool isLocked() const { return locked; }
 
     bool hasAllInfo() const;
 
@@ -69,6 +69,8 @@ public:
 
     bool contains(const Input & other) const;
 
+    /* Fetch the input into the Nix store, returning the location in
+       the Nix store and the locked input. */
     std::pair<Tree, Input> fetch(ref<Store> store) const;
 
     Input applyOverrides(
@@ -146,14 +148,14 @@ DownloadFileResult downloadFile(
     ref<Store> store,
     const std::string & url,
     const std::string & name,
-    bool immutable,
+    bool locked,
     const Headers & headers = {});
 
 std::pair<Tree, time_t> downloadTarball(
     ref<Store> store,
     const std::string & url,
     const std::string & name,
-    bool immutable,
+    bool locked,
     const Headers & headers = {});
 
 }
diff --git a/src/libfetchers/git.cc b/src/libfetchers/git.cc
index c3f0f8c8f..7f65c1533 100644
--- a/src/libfetchers/git.cc
+++ b/src/libfetchers/git.cc
@@ -187,7 +187,7 @@ struct GitInputScheme : InputScheme
         if (submodules) cacheType += "-submodules";
         if (allRefs) cacheType += "-all-refs";
 
-        auto getImmutableAttrs = [&]()
+        auto getLockedAttrs = [&]()
         {
             return Attrs({
                 {"type", cacheType},
@@ -208,7 +208,7 @@ struct GitInputScheme : InputScheme
         };
 
         if (input.getRev()) {
-            if (auto res = getCache()->lookup(store, getImmutableAttrs()))
+            if (auto res = getCache()->lookup(store, getLockedAttrs()))
                 return makeResult(res->first, std::move(res->second));
         }
 
@@ -288,7 +288,7 @@ struct GitInputScheme : InputScheme
 
         if (!input.getRef()) input.attrs.insert_or_assign("ref", isLocal ? readHead(actualUrl) : "master");
 
-        Attrs mutableAttrs({
+        Attrs unlockedAttrs({
             {"type", cacheType},
             {"name", name},
             {"url", actualUrl},
@@ -307,7 +307,7 @@ struct GitInputScheme : InputScheme
 
         } else {
 
-            if (auto res = getCache()->lookup(store, mutableAttrs)) {
+            if (auto res = getCache()->lookup(store, unlockedAttrs)) {
                 auto rev2 = Hash::parseAny(getStrAttr(res->first, "rev"), htSHA1);
                 if (!input.getRev() || input.getRev() == rev2) {
                     input.attrs.insert_or_assign("rev", rev2.gitRev());
@@ -404,7 +404,7 @@ struct GitInputScheme : InputScheme
 
         /* Now that we know the ref, check again whether we have it in
            the store. */
-        if (auto res = getCache()->lookup(store, getImmutableAttrs()))
+        if (auto res = getCache()->lookup(store, getLockedAttrs()))
             return makeResult(res->first, std::move(res->second));
 
         Path tmpDir = createTempDir();
@@ -476,14 +476,14 @@ struct GitInputScheme : InputScheme
         if (!_input.getRev())
             getCache()->add(
                 store,
-                mutableAttrs,
+                unlockedAttrs,
                 infoAttrs,
                 storePath,
                 false);
 
         getCache()->add(
             store,
-            getImmutableAttrs(),
+            getLockedAttrs(),
             infoAttrs,
             storePath,
             true);
diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index 2b3705b1b..70622bf79 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -193,12 +193,12 @@ struct GitArchiveInputScheme : InputScheme
         input.attrs.erase("ref");
         input.attrs.insert_or_assign("rev", rev->gitRev());
 
-        Attrs immutableAttrs({
+        Attrs lockedAttrs({
             {"type", "git-tarball"},
             {"rev", rev->gitRev()},
         });
 
-        if (auto res = getCache()->lookup(store, immutableAttrs)) {
+        if (auto res = getCache()->lookup(store, lockedAttrs)) {
             input.attrs.insert_or_assign("lastModified", getIntAttr(res->first, "lastModified"));
             return {std::move(res->second), input};
         }
@@ -211,7 +211,7 @@ struct GitArchiveInputScheme : InputScheme
 
         getCache()->add(
             store,
-            immutableAttrs,
+            lockedAttrs,
             {
                 {"rev", rev->gitRev()},
                 {"lastModified", uint64_t(lastModified)}
diff --git a/src/libfetchers/mercurial.cc b/src/libfetchers/mercurial.cc
index 5123bcda4..798369c7a 100644
--- a/src/libfetchers/mercurial.cc
+++ b/src/libfetchers/mercurial.cc
@@ -199,7 +199,7 @@ struct MercurialInputScheme : InputScheme
 
         if (!input.getRef()) input.attrs.insert_or_assign("ref", "default");
 
-        auto getImmutableAttrs = [&]()
+        auto getLockedAttrs = [&]()
         {
             return Attrs({
                 {"type", "hg"},
@@ -218,20 +218,20 @@ struct MercurialInputScheme : InputScheme
         };
 
         if (input.getRev()) {
-            if (auto res = getCache()->lookup(store, getImmutableAttrs()))
+            if (auto res = getCache()->lookup(store, getLockedAttrs()))
                 return makeResult(res->first, std::move(res->second));
         }
 
         auto revOrRef = input.getRev() ? input.getRev()->gitRev() : *input.getRef();
 
-        Attrs mutableAttrs({
+        Attrs unlockedAttrs({
             {"type", "hg"},
             {"name", name},
             {"url", actualUrl},
             {"ref", *input.getRef()},
         });
 
-        if (auto res = getCache()->lookup(store, mutableAttrs)) {
+        if (auto res = getCache()->lookup(store, unlockedAttrs)) {
             auto rev2 = Hash::parseAny(getStrAttr(res->first, "rev"), htSHA1);
             if (!input.getRev() || input.getRev() == rev2) {
                 input.attrs.insert_or_assign("rev", rev2.gitRev());
@@ -277,7 +277,7 @@ struct MercurialInputScheme : InputScheme
         auto revCount = std::stoull(tokens[1]);
         input.attrs.insert_or_assign("ref", tokens[2]);
 
-        if (auto res = getCache()->lookup(store, getImmutableAttrs()))
+        if (auto res = getCache()->lookup(store, getLockedAttrs()))
             return makeResult(res->first, std::move(res->second));
 
         Path tmpDir = createTempDir();
@@ -297,14 +297,14 @@ struct MercurialInputScheme : InputScheme
         if (!_input.getRev())
             getCache()->add(
                 store,
-                mutableAttrs,
+                unlockedAttrs,
                 infoAttrs,
                 storePath,
                 false);
 
         getCache()->add(
             store,
-            getImmutableAttrs(),
+            getLockedAttrs(),
             infoAttrs,
             storePath,
             true);
diff --git a/src/libfetchers/tarball.cc b/src/libfetchers/tarball.cc
index 74c8097ff..dde0ad761 100644
--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@@ -13,7 +13,7 @@ DownloadFileResult downloadFile(
     ref<Store> store,
     const std::string & url,
     const std::string & name,
-    bool immutable,
+    bool locked,
     const Headers & headers)
 {
     // FIXME: check store
@@ -88,7 +88,7 @@ DownloadFileResult downloadFile(
         inAttrs,
         infoAttrs,
         *storePath,
-        immutable);
+        locked);
 
     if (url != res.effectiveUri)
         getCache()->add(
@@ -100,7 +100,7 @@ DownloadFileResult downloadFile(
             },
             infoAttrs,
             *storePath,
-            immutable);
+            locked);
 
     return {
         .storePath = std::move(*storePath),
@@ -113,7 +113,7 @@ std::pair<Tree, time_t> downloadTarball(
     ref<Store> store,
     const std::string & url,
     const std::string & name,
-    bool immutable,
+    bool locked,
     const Headers & headers)
 {
     Attrs inAttrs({
@@ -130,7 +130,7 @@ std::pair<Tree, time_t> downloadTarball(
             getIntAttr(cached->infoAttrs, "lastModified")
         };
 
-    auto res = downloadFile(store, url, name, immutable, headers);
+    auto res = downloadFile(store, url, name, locked, headers);
 
     std::optional<StorePath> unpackedStorePath;
     time_t lastModified;
@@ -160,7 +160,7 @@ std::pair<Tree, time_t> downloadTarball(
         inAttrs,
         infoAttrs,
         *unpackedStorePath,
-        immutable);
+        locked);
 
     return {
         Tree { .actualPath = store->toRealPath(*unpackedStorePath), .storePath = std::move(*unpackedStorePath) },
@@ -202,7 +202,7 @@ struct TarballInputScheme : InputScheme
 
         Input input;
         input.attrs = attrs;
-        //input.immutable = (bool) maybeGetStrAttr(input.attrs, "hash");
+        //input.locked = (bool) maybeGetStrAttr(input.attrs, "hash");
         return input;
     }
 
diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index 508cbd336..0e8dc4380 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -415,7 +415,7 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
         for (size_t i = 0; i < manifest.elements.size(); ++i) {
             auto & element(manifest.elements[i]);
             if (element.source
-                && !element.source->originalRef.input.isImmutable()
+                && !element.source->originalRef.input.isLocked()
                 && matches(*store, element, i, matchers))
             {
                 upgradedCount++;
diff --git a/src/nix/repl.cc b/src/nix/repl.cc
index 60454471d..575eb0c4c 100644
--- a/src/nix/repl.cc
+++ b/src/nix/repl.cc
@@ -627,8 +627,8 @@ void NixRepl::loadFlake(const std::string & flakeRefS)
         throw Error("cannot use ':load-flake' without a path specified. (Use '.' for the current working directory.)");
 
     auto flakeRef = parseFlakeRef(flakeRefS, absPath("."), true);
-    if (evalSettings.pureEval && !flakeRef.input.isImmutable())
-        throw Error("cannot use ':load-flake' on mutable flake reference '%s' (use --impure to override)", flakeRefS);
+    if (evalSettings.pureEval && !flakeRef.input.isLocked())
+        throw Error("cannot use ':load-flake' on locked flake reference '%s' (use --impure to override)", flakeRefS);
 
     Value v;
 

From 9d4697453fc760597befa2e3eb887d2d6d375492 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 25 Feb 2022 09:21:04 +0100
Subject: [PATCH 19/52] ExprAttrs::show(): Show attrs in sorted order

Issue #6160.
---
 src/libexpr/nixexpr.cc | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/src/libexpr/nixexpr.cc b/src/libexpr/nixexpr.cc
index 2d2cd96cd..27ea0f2ad 100644
--- a/src/libexpr/nixexpr.cc
+++ b/src/libexpr/nixexpr.cc
@@ -103,11 +103,18 @@ void ExprAttrs::show(std::ostream & str) const
 {
     if (recursive) str << "rec ";
     str << "{ ";
-    for (auto & i : attrs)
-        if (i.second.inherited)
-            str << "inherit " << i.first << " " << "; ";
+    typedef const decltype(attrs)::value_type * Attr;
+    std::vector<Attr> sorted;
+    for (auto & i : attrs) sorted.push_back(&i);
+        std::sort(sorted.begin(), sorted.end(), [](Attr a, Attr b) {
+            return (const std::string &) a->first < (const std::string &) b->first;
+        });
+    for (auto & i : sorted) {
+        if (i->second.inherited)
+            str << "inherit " << i->first << " " << "; ";
         else
-            str << i.first << " = " << *i.second.e << "; ";
+            str << i->first << " = " << *i->second.e << "; ";
+    }
     for (auto & i : dynamicAttrs)
         str << "\"${" << *i.nameExpr << "}\" = " << *i.valueExpr << "; ";
     str << "}";

From b312d4d09699fc7681b20a956a95c6964cef73e3 Mon Sep 17 00:00:00 2001
From: Kevin Amado <kamadorueda@gmail.com>
Date: Fri, 25 Feb 2022 09:16:16 -0500
Subject: [PATCH 20/52] refactor: remove verbose-build from docs

- From what I see it is an implementation detail
  but is no longer configurable from the settings
---
 src/libstore/globals.hh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index 893c95bd6..4a78729e9 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -113,7 +113,7 @@ public:
     bool verboseBuild = true;
 
     Setting<size_t> logLines{this, 10, "log-lines",
-        "If `verbose-build` is false, the number of lines of the tail of "
+        "The number of lines of the tail of "
         "the log to show if a build fails."};
 
     MaxBuildJobsSetting maxBuildJobs{

From 14b38d0887f8a8d6b75039113eface57cfb19d06 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 25 Feb 2022 13:39:38 +0100
Subject: [PATCH 21/52] xml-writer: Remove std aliases

---
 src/libutil/xml-writer.cc | 10 ++++++----
 src/libutil/xml-writer.hh | 14 +++++---------
 src/nix-env/nix-env.cc    |  2 +-
 3 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/src/libutil/xml-writer.cc b/src/libutil/xml-writer.cc
index 68857e34d..7993bee9a 100644
--- a/src/libutil/xml-writer.cc
+++ b/src/libutil/xml-writer.cc
@@ -31,11 +31,12 @@ void XMLWriter::close()
 void XMLWriter::indent_(size_t depth)
 {
     if (!indent) return;
-    output << string(depth * 2, ' ');
+    output << std::string(depth * 2, ' ');
 }
 
 
-void XMLWriter::openElement(const string & name,
+void XMLWriter::openElement(
+    std::string_view name,
     const XMLAttrs & attrs)
 {
     assert(!closed);
@@ -44,7 +45,7 @@ void XMLWriter::openElement(const string & name,
     writeAttrs(attrs);
     output << ">";
     if (indent) output << std::endl;
-    pendingElems.push_back(name);
+    pendingElems.push_back(std::string(name));
 }
 
 
@@ -59,7 +60,8 @@ void XMLWriter::closeElement()
 }
 
 
-void XMLWriter::writeEmptyElement(const string & name,
+void XMLWriter::writeEmptyElement(
+    std::string_view name,
     const XMLAttrs & attrs)
 {
     assert(!closed);
diff --git a/src/libutil/xml-writer.hh b/src/libutil/xml-writer.hh
index b98b44526..4c91adee6 100644
--- a/src/libutil/xml-writer.hh
+++ b/src/libutil/xml-writer.hh
@@ -8,12 +8,8 @@
 
 namespace nix {
 
-using std::string;
-using std::map;
-using std::list;
 
-
-typedef map<string, string> XMLAttrs;
+typedef std::map<std::string, std::string> XMLAttrs;
 
 
 class XMLWriter
@@ -25,7 +21,7 @@ private:
     bool indent;
     bool closed;
 
-    list<string> pendingElems;
+    std::list<std::string> pendingElems;
 
 public:
 
@@ -34,11 +30,11 @@ public:
 
     void close();
 
-    void openElement(const string & name,
+    void openElement(std::string_view name,
         const XMLAttrs & attrs = XMLAttrs());
     void closeElement();
 
-    void writeEmptyElement(const string & name,
+    void writeEmptyElement(std::string_view name,
         const XMLAttrs & attrs = XMLAttrs());
 
 private:
@@ -53,7 +49,7 @@ class XMLOpenElement
 private:
     XMLWriter & writer;
 public:
-    XMLOpenElement(XMLWriter & writer, const string & name,
+    XMLOpenElement(XMLWriter & writer, std::string_view name,
         const XMLAttrs & attrs = XMLAttrs())
         : writer(writer)
     {
diff --git a/src/nix-env/nix-env.cc b/src/nix-env/nix-env.cc
index 52d07e3df..f83edb6a1 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix-env/nix-env.cc
@@ -833,7 +833,7 @@ static bool cmpElemByName(const DrvInfo & a, const DrvInfo & b)
 }
 
 
-typedef list<Strings> Table;
+typedef std::list<Strings> Table;
 
 
 void printTable(Table & table)

From df552ff53e68dff8ca360adbdbea214ece1d08ee Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 25 Feb 2022 16:00:00 +0100
Subject: [PATCH 22/52] Remove std::string alias (for real this time)

Also use std::string_view in a few more places.
---
 perl/lib/Nix/Store.xs                         |  2 +-
 src/build-remote/build-remote.cc              | 10 +--
 src/libexpr/attr-path.cc                      |  6 +-
 src/libexpr/attr-path.hh                      |  7 +-
 src/libexpr/attr-set.hh                       |  2 +-
 src/libexpr/common-eval-args.cc               |  8 +-
 src/libexpr/common-eval-args.hh               |  2 +-
 src/libexpr/eval-cache.cc                     |  2 +-
 src/libexpr/eval.cc                           | 66 +++++++--------
 src/libexpr/eval.hh                           | 20 ++---
 src/libexpr/flake/flake.cc                    |  4 +-
 src/libexpr/get-drvs.cc                       | 40 ++++-----
 src/libexpr/get-drvs.hh                       | 46 +++++-----
 src/libexpr/nixexpr.cc                        | 14 ++--
 src/libexpr/nixexpr.hh                        | 19 +++--
 src/libexpr/parser.y                          | 30 +++----
 src/libexpr/primops.cc                        | 46 +++++-----
 src/libexpr/primops/context.cc                | 10 +--
 src/libexpr/primops/fetchMercurial.cc         |  2 +-
 src/libexpr/primops/fetchTree.cc              |  4 +-
 src/libexpr/primops/fromTOML.cc               |  2 +-
 src/libexpr/value-to-xml.cc                   |  2 +-
 src/libfetchers/mercurial.cc                  |  4 +-
 src/libmain/common-args.cc                    |  2 +-
 src/libmain/common-args.hh                    |  4 +-
 src/libmain/shared.cc                         | 16 ++--
 src/libmain/shared.hh                         | 14 ++--
 src/libstore/binary-cache-store.cc            | 17 +++-
 src/libstore/binary-cache-store.hh            | 18 ++--
 src/libstore/build/derivation-goal.cc         | 14 ++--
 src/libstore/build/derivation-goal.hh         |  4 +-
 .../build/drv-output-substitution-goal.cc     |  2 +-
 .../build/drv-output-substitution-goal.hh     |  2 +-
 src/libstore/build/goal.cc                    |  4 +-
 src/libstore/build/goal.hh                    |  8 +-
 src/libstore/build/local-derivation-goal.cc   | 64 ++++++++------
 src/libstore/build/local-derivation-goal.hh   |  2 +-
 src/libstore/build/substitution-goal.cc       |  2 +-
 src/libstore/build/substitution-goal.hh       |  4 +-
 src/libstore/build/worker.cc                  |  2 +-
 src/libstore/builtins/buildenv.cc             |  4 +-
 src/libstore/builtins/fetchurl.cc             |  2 +-
 src/libstore/builtins/unpack-channel.cc       |  2 +-
 src/libstore/daemon.cc                        |  8 +-
 src/libstore/derivations.cc                   | 32 +++----
 src/libstore/derivations.hh                   | 12 ++-
 src/libstore/derived-path.cc                  |  4 +-
 src/libstore/dummy-store.cc                   |  9 +-
 src/libstore/filetransfer.cc                  | 26 +++---
 src/libstore/filetransfer.hh                  |  8 +-
 src/libstore/gc.cc                            | 23 +++--
 src/libstore/globals.cc                       |  4 +-
 src/libstore/globals.hh                       |  2 +-
 src/libstore/legacy-ssh-store.cc              | 22 +++--
 src/libstore/local-fs-store.cc                |  2 +-
 src/libstore/local-fs-store.hh                |  2 +-
 src/libstore/local-store.cc                   | 29 ++++---
 src/libstore/local-store.hh                   | 13 ++-
 src/libstore/lock.hh                          |  4 +-
 src/libstore/machines.cc                      | 21 ++---
 src/libstore/nar-accessor.cc                  |  2 +-
 src/libstore/nar-info.cc                      |  2 +-
 src/libstore/optimise-store.cc                |  2 +-
 src/libstore/path-with-outputs.cc             |  4 +-
 src/libstore/path.hh                          |  2 +-
 src/libstore/pathlocks.cc                     |  4 +-
 src/libstore/pathlocks.hh                     |  4 +-
 src/libstore/profiles.cc                      | 16 ++--
 src/libstore/profiles.hh                      |  4 +-
 src/libstore/references.cc                    |  4 +-
 src/libstore/remote-store.cc                  | 11 ++-
 src/libstore/remote-store.hh                  |  7 +-
 src/libstore/s3-binary-cache-store.cc         | 11 ++-
 src/libstore/sqlite.cc                        |  2 +-
 src/libstore/ssh.cc                           |  2 +-
 src/libstore/store-api.cc                     | 32 ++++---
 src/libstore/store-api.hh                     | 26 ++++--
 src/libutil/archive.cc                        | 28 +++----
 src/libutil/archive.hh                        |  6 +-
 src/libutil/args.cc                           | 12 +--
 src/libutil/args.hh                           |  2 +-
 src/libutil/config.cc                         | 14 ++--
 src/libutil/error.cc                          | 12 +--
 src/libutil/error.hh                          | 26 +++---
 src/libutil/fmt.hh                            |  7 +-
 src/libutil/hash.cc                           | 19 +++--
 src/libutil/hash.hh                           |  6 +-
 src/libutil/logging.cc                        |  2 +-
 src/libutil/logging.hh                        |  2 +-
 src/libutil/serialise.cc                      |  4 +-
 src/libutil/serialise.hh                      |  4 +-
 src/libutil/tests/url.cc                      | 18 ++--
 src/libutil/types.hh                          |  1 +
 src/libutil/util.cc                           | 84 +++++++++----------
 src/libutil/util.hh                           | 44 +++++-----
 src/nix-build/nix-build.cc                    | 16 ++--
 src/nix-channel/nix-channel.cc                | 14 ++--
 .../nix-collect-garbage.cc                    |  2 +-
 src/nix-env/nix-env.cc                        | 82 +++++++++---------
 src/nix-env/user-env.cc                       |  2 +-
 src/nix-env/user-env.hh                       |  2 +-
 src/nix-instantiate/nix-instantiate.cc        |  2 +-
 src/nix-store/dotgraph.cc                     | 26 +++---
 src/nix-store/graphml.cc                      |  8 +-
 src/nix-store/nix-store.cc                    | 16 ++--
 src/nix/daemon.cc                             | 16 ++--
 src/nix/hash.cc                               |  2 +-
 src/nix/prefetch.cc                           | 14 ++--
 src/nix/repl.cc                               | 66 +++++++--------
 src/nix/why-depends.cc                        |  4 +-
 110 files changed, 773 insertions(+), 681 deletions(-)

diff --git a/perl/lib/Nix/Store.xs b/perl/lib/Nix/Store.xs
index edbf12f7c..54ad1680c 100644
--- a/perl/lib/Nix/Store.xs
+++ b/perl/lib/Nix/Store.xs
@@ -240,7 +240,7 @@ SV * convertHash(char * algo, char * s, int toBase32)
     PPCODE:
         try {
             auto h = Hash::parseAny(s, parseHashType(algo));
-            string s = h.to_string(toBase32 ? Base32 : Base16, false);
+            auto s = h.to_string(toBase32 ? Base32 : Base16, false);
             XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
         } catch (Error & e) {
             croak("%s", e.what());
diff --git a/src/build-remote/build-remote.cc b/src/build-remote/build-remote.cc
index 4d7b602d8..9d2eacb54 100644
--- a/src/build-remote/build-remote.cc
+++ b/src/build-remote/build-remote.cc
@@ -32,7 +32,7 @@ std::string escapeUri(std::string uri)
     return uri;
 }
 
-static string currentLoad;
+static std::string currentLoad;
 
 static AutoCloseFD openSlotLock(const Machine & m, uint64_t slot)
 {
@@ -97,7 +97,7 @@ static int main_build_remote(int argc, char * * argv)
         }
 
         std::optional<StorePath> drvPath;
-        string storeUri;
+        std::string storeUri;
 
         while (true) {
 
@@ -183,7 +183,7 @@ static int main_build_remote(int argc, char * * argv)
                     else
                     {
                         // build the hint template.
-                        string errorText =
+                        std::string errorText =
                             "Failed to find a machine for remote build!\n"
                             "derivation: %s\nrequired (system, features): (%s, %s)";
                         errorText += "\n%s available machines:";
@@ -193,7 +193,7 @@ static int main_build_remote(int argc, char * * argv)
                             errorText += "\n(%s, %s, %s, %s)";
 
                         // add the template values.
-                        string drvstr;
+                        std::string drvstr;
                         if (drvPath.has_value())
                             drvstr = drvPath->to_string();
                         else
@@ -208,7 +208,7 @@ static int main_build_remote(int argc, char * * argv)
 
                         for (auto & m : machines)
                             error
-                                % concatStringsSep<std::vector<string>>(", ", m.systemTypes)
+                                % concatStringsSep<std::vector<std::string>>(", ", m.systemTypes)
                                 % m.maxJobs
                                 % concatStringsSep<StringSet>(", ", m.supportedFeatures)
                                 % concatStringsSep<StringSet>(", ", m.mandatoryFeatures);
diff --git a/src/libexpr/attr-path.cc b/src/libexpr/attr-path.cc
index bf0c1dabc..eb0e706c7 100644
--- a/src/libexpr/attr-path.cc
+++ b/src/libexpr/attr-path.cc
@@ -9,7 +9,7 @@ namespace nix {
 static Strings parseAttrPath(std::string_view s)
 {
     Strings res;
-    string cur;
+    std::string cur;
     auto i = s.begin();
     while (i != s.end()) {
         if (*i == '.') {
@@ -41,7 +41,7 @@ std::vector<Symbol> parseAttrPath(EvalState & state, std::string_view s)
 }
 
 
-std::pair<Value *, Pos> findAlongAttrPath(EvalState & state, const string & attrPath,
+std::pair<Value *, Pos> findAlongAttrPath(EvalState & state, const std::string & attrPath,
     Bindings & autoArgs, Value & vIn)
 {
     Strings tokens = parseAttrPath(attrPath);
@@ -121,7 +121,7 @@ Pos findPackageFilename(EvalState & state, Value & v, std::string what)
     std::string filename(pos, 0, colon);
     unsigned int lineno;
     try {
-        lineno = std::stoi(std::string(pos, colon + 1, string::npos));
+        lineno = std::stoi(std::string(pos, colon + 1, std::string::npos));
     } catch (std::invalid_argument & e) {
         throw ParseError("cannot parse line number '%s'", pos);
     }
diff --git a/src/libexpr/attr-path.hh b/src/libexpr/attr-path.hh
index 2ee3ea089..ff1135a06 100644
--- a/src/libexpr/attr-path.hh
+++ b/src/libexpr/attr-path.hh
@@ -10,8 +10,11 @@ namespace nix {
 MakeError(AttrPathNotFound, Error);
 MakeError(NoPositionInfo, Error);
 
-std::pair<Value *, Pos> findAlongAttrPath(EvalState & state, const string & attrPath,
-    Bindings & autoArgs, Value & vIn);
+std::pair<Value *, Pos> findAlongAttrPath(
+    EvalState & state,
+    const std::string & attrPath,
+    Bindings & autoArgs,
+    Value & vIn);
 
 /* Heuristic to find the filename and lineno or a nix value. */
 Pos findPackageFilename(EvalState & state, Value & v, std::string what);
diff --git a/src/libexpr/attr-set.hh b/src/libexpr/attr-set.hh
index 3e4899efc..cad9743ea 100644
--- a/src/libexpr/attr-set.hh
+++ b/src/libexpr/attr-set.hh
@@ -105,7 +105,7 @@ public:
         for (size_t n = 0; n < size_; n++)
             res.emplace_back(&attrs[n]);
         std::sort(res.begin(), res.end(), [](const Attr * a, const Attr * b) {
-            return (const string &) a->name < (const string &) b->name;
+            return (const std::string &) a->name < (const std::string &) b->name;
         });
         return res;
     }
diff --git a/src/libexpr/common-eval-args.cc b/src/libexpr/common-eval-args.cc
index fffca4ac5..e50ff244c 100644
--- a/src/libexpr/common-eval-args.cc
+++ b/src/libexpr/common-eval-args.cc
@@ -77,7 +77,7 @@ Bindings * MixEvalArgs::getAutoArgs(EvalState & state)
     for (auto & i : autoArgs) {
         auto v = state.allocValue();
         if (i.second[0] == 'E')
-            state.mkThunk_(*v, state.parseExprFromString(string(i.second, 1), absPath(".")));
+            state.mkThunk_(*v, state.parseExprFromString(i.second.substr(1), absPath(".")));
         else
             v->mkString(((std::string_view) i.second).substr(1));
         res.insert(state.symbols.create(i.first), v);
@@ -85,17 +85,17 @@ Bindings * MixEvalArgs::getAutoArgs(EvalState & state)
     return res.finish();
 }
 
-Path lookupFileArg(EvalState & state, string s)
+Path lookupFileArg(EvalState & state, std::string_view s)
 {
     if (isUri(s)) {
         return state.store->toRealPath(
             fetchers::downloadTarball(
                 state.store, resolveUri(s), "source", false).first.storePath);
     } else if (s.size() > 2 && s.at(0) == '<' && s.at(s.size() - 1) == '>') {
-        Path p = s.substr(1, s.size() - 2);
+        Path p(s.substr(1, s.size() - 2));
         return state.findFile(p);
     } else
-        return absPath(s);
+        return absPath(std::string(s));
 }
 
 }
diff --git a/src/libexpr/common-eval-args.hh b/src/libexpr/common-eval-args.hh
index 0e113fff1..03fa226aa 100644
--- a/src/libexpr/common-eval-args.hh
+++ b/src/libexpr/common-eval-args.hh
@@ -22,6 +22,6 @@ private:
     std::map<std::string, std::string> autoArgs;
 };
 
-Path lookupFileArg(EvalState & state, string s);
+Path lookupFileArg(EvalState & state, std::string_view s);
 
 }
diff --git a/src/libexpr/eval-cache.cc b/src/libexpr/eval-cache.cc
index d6b9ea29b..00d0749f9 100644
--- a/src/libexpr/eval-cache.cc
+++ b/src/libexpr/eval-cache.cc
@@ -596,7 +596,7 @@ std::vector<Symbol> AttrCursor::getAttrs()
     for (auto & attr : *getValue().attrs)
         attrs.push_back(attr.name);
     std::sort(attrs.begin(), attrs.end(), [](const Symbol & a, const Symbol & b) {
-        return (const string &) a < (const string &) b;
+        return (const std::string &) a < (const std::string &) b;
     });
 
     if (root->db)
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 2d4eb57fc..60f0bf08c 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -174,7 +174,7 @@ std::ostream & operator << (std::ostream & str, const Value & v)
 }
 
 
-const Value *getPrimOp(const Value &v) {
+const Value * getPrimOp(const Value &v) {
     const Value * primOp = &v;
     while (primOp->isPrimOpApp()) {
         primOp = primOp->primOpApp.left;
@@ -183,7 +183,7 @@ const Value *getPrimOp(const Value &v) {
     return primOp;
 }
 
-string showType(ValueType type)
+std::string_view showType(ValueType type)
 {
     switch (type) {
         case nInt: return "an integer";
@@ -202,20 +202,20 @@ string showType(ValueType type)
 }
 
 
-string showType(const Value & v)
+std::string showType(const Value & v)
 {
     switch (v.internalType) {
         case tString: return v.string.context ? "a string with context" : "a string";
         case tPrimOp:
-            return fmt("the built-in function '%s'", string(v.primOp->name));
+            return fmt("the built-in function '%s'", std::string(v.primOp->name));
         case tPrimOpApp:
-            return fmt("the partially applied built-in function '%s'", string(getPrimOp(v)->primOp->name));
+            return fmt("the partially applied built-in function '%s'", std::string(getPrimOp(v)->primOp->name));
         case tExternal: return v.external->showType();
         case tThunk: return "a thunk";
         case tApp: return "a function application";
         case tBlackhole: return "a black hole";
     default:
-        return showType(v.type());
+        return std::string(showType(v.type()));
     }
 }
 
@@ -356,7 +356,7 @@ void initGC()
 
 /* Very hacky way to parse $NIX_PATH, which is colon-separated, but
    can contain URLs (e.g. "nixpkgs=https://bla...:foo=https://"). */
-static Strings parseNixPath(const string & s)
+static Strings parseNixPath(const std::string & s)
 {
     Strings res;
 
@@ -606,7 +606,7 @@ Path EvalState::toRealPath(const Path & path, const PathSet & context)
 }
 
 
-Value * EvalState::addConstant(const string & name, Value & v)
+Value * EvalState::addConstant(const std::string & name, Value & v)
 {
     Value * v2 = allocValue();
     *v2 = v;
@@ -615,19 +615,19 @@ Value * EvalState::addConstant(const string & name, Value & v)
 }
 
 
-void EvalState::addConstant(const string & name, Value * v)
+void EvalState::addConstant(const std::string & name, Value * v)
 {
     staticBaseEnv.vars.emplace_back(symbols.create(name), baseEnvDispl);
     baseEnv.values[baseEnvDispl++] = v;
-    string name2 = string(name, 0, 2) == "__" ? string(name, 2) : name;
+    auto name2 = name.substr(0, 2) == "__" ? name.substr(2) : name;
     baseEnv.values[0]->attrs->push_back(Attr(symbols.create(name2), v));
 }
 
 
-Value * EvalState::addPrimOp(const string & name,
+Value * EvalState::addPrimOp(const std::string & name,
     size_t arity, PrimOpFun primOp)
 {
-    auto name2 = string(name, 0, 2) == "__" ? string(name, 2) : name;
+    auto name2 = name.substr(0, 2) == "__" ? name.substr(2) : name;
     Symbol sym = symbols.create(name2);
 
     /* Hack to make constants lazy: turn them into a application of
@@ -675,7 +675,7 @@ Value * EvalState::addPrimOp(PrimOp && primOp)
 }
 
 
-Value & EvalState::getBuiltin(const string & name)
+Value & EvalState::getBuiltin(const std::string & name)
 {
     return *baseEnv.values[0]->attrs->find(symbols.create(name))->value;
 }
@@ -703,12 +703,12 @@ std::optional<EvalState::Doc> EvalState::getDoc(Value & v)
    evaluator.  So here are some helper functions for throwing
    exceptions. */
 
-LocalNoInlineNoReturn(void throwEvalError(const char * s, const string & s2))
+LocalNoInlineNoReturn(void throwEvalError(const char * s, const std::string & s2))
 {
     throw EvalError(s, s2);
 }
 
-LocalNoInlineNoReturn(void throwEvalError(const Pos & pos, const char * s, const string & s2))
+LocalNoInlineNoReturn(void throwEvalError(const Pos & pos, const char * s, const std::string & s2))
 {
     throw EvalError({
         .msg = hintfmt(s, s2),
@@ -716,12 +716,12 @@ LocalNoInlineNoReturn(void throwEvalError(const Pos & pos, const char * s, const
     });
 }
 
-LocalNoInlineNoReturn(void throwEvalError(const char * s, const string & s2, const string & s3))
+LocalNoInlineNoReturn(void throwEvalError(const char * s, const std::string & s2, const std::string & s3))
 {
     throw EvalError(s, s2, s3);
 }
 
-LocalNoInlineNoReturn(void throwEvalError(const Pos & pos, const char * s, const string & s2, const string & s3))
+LocalNoInlineNoReturn(void throwEvalError(const Pos & pos, const char * s, const std::string & s2, const std::string & s3))
 {
     throw EvalError({
         .msg = hintfmt(s, s2, s3),
@@ -759,7 +759,7 @@ LocalNoInlineNoReturn(void throwTypeError(const char * s, const Value & v))
     throw TypeError(s, showType(v));
 }
 
-LocalNoInlineNoReturn(void throwAssertionError(const Pos & pos, const char * s, const string & s1))
+LocalNoInlineNoReturn(void throwAssertionError(const Pos & pos, const char * s, const std::string & s1))
 {
     throw AssertionError({
         .msg = hintfmt(s, s1),
@@ -767,7 +767,7 @@ LocalNoInlineNoReturn(void throwAssertionError(const Pos & pos, const char * s,
     });
 }
 
-LocalNoInlineNoReturn(void throwUndefinedVarError(const Pos & pos, const char * s, const string & s1))
+LocalNoInlineNoReturn(void throwUndefinedVarError(const Pos & pos, const char * s, const std::string & s1))
 {
     throw UndefinedVarError({
         .msg = hintfmt(s, s1),
@@ -775,7 +775,7 @@ LocalNoInlineNoReturn(void throwUndefinedVarError(const Pos & pos, const char *
     });
 }
 
-LocalNoInlineNoReturn(void throwMissingArgumentError(const Pos & pos, const char * s, const string & s1))
+LocalNoInlineNoReturn(void throwMissingArgumentError(const Pos & pos, const char * s, const std::string & s1))
 {
     throw MissingArgumentError({
         .msg = hintfmt(s, s1),
@@ -783,12 +783,12 @@ LocalNoInlineNoReturn(void throwMissingArgumentError(const Pos & pos, const char
     });
 }
 
-LocalNoInline(void addErrorTrace(Error & e, const char * s, const string & s2))
+LocalNoInline(void addErrorTrace(Error & e, const char * s, const std::string & s2))
 {
     e.addTrace(std::nullopt, s, s2);
 }
 
-LocalNoInline(void addErrorTrace(Error & e, const Pos & pos, const char * s, const string & s2))
+LocalNoInline(void addErrorTrace(Error & e, const Pos & pos, const char * s, const std::string & s2))
 {
     e.addTrace(pos, s, s2);
 }
@@ -1221,7 +1221,7 @@ void ExprVar::eval(EvalState & state, Env & env, Value & v)
 }
 
 
-static string showAttrPath(EvalState & state, Env & env, const AttrPath & attrPath)
+static std::string showAttrPath(EvalState & state, Env & env, const AttrPath & attrPath)
 {
     std::ostringstream out;
     bool first = true;
@@ -1395,7 +1395,7 @@ void EvalState::callFunction(Value & fun, size_t nrArgs, Value * * args, Value &
                 if (loggerSettings.showTrace.get()) {
                     addErrorTrace(e, lambda.pos, "while evaluating %s",
                         (lambda.name.set()
-                            ? "'" + (string) lambda.name + "'"
+                            ? "'" + (const std::string &) lambda.name + "'"
                             : "anonymous lambda"));
                     addErrorTrace(e, pos, "from call site%s", "");
                 }
@@ -1883,7 +1883,7 @@ std::string_view EvalState::forceString(Value & v, const Pos & pos)
 
 /* Decode a context string ‘!<name>!<path>’ into a pair <path,
    name>. */
-std::pair<string, string> decodeContext(std::string_view s)
+std::pair<std::string, std::string> decodeContext(std::string_view s)
 {
     if (s.at(0) == '!') {
         size_t index = s.find("!", 1);
@@ -1946,7 +1946,7 @@ bool EvalState::isDerivation(Value & v)
 }
 
 
-std::optional<string> EvalState::tryAttrsToString(const Pos & pos, Value & v,
+std::optional<std::string> EvalState::tryAttrsToString(const Pos & pos, Value & v,
     PathSet & context, bool coerceMore, bool copyToStore)
 {
     auto i = v.attrs->find(sToString);
@@ -2001,7 +2001,7 @@ BackedStringView EvalState::coerceToString(const Pos & pos, Value & v, PathSet &
         if (v.type() == nNull) return "";
 
         if (v.isList()) {
-            string result;
+            std::string result;
             for (auto [n, v2] : enumerate(v.listItems())) {
                 result += *coerceToString(pos, *v2, context, coerceMore, copyToStore);
                 if (n < v.listSize() - 1
@@ -2017,7 +2017,7 @@ BackedStringView EvalState::coerceToString(const Pos & pos, Value & v, PathSet &
 }
 
 
-string EvalState::copyPathToStore(PathSet & context, const Path & path)
+std::string EvalState::copyPathToStore(PathSet & context, const Path & path)
 {
     if (nix::isDerivation(path))
         throwEvalError("file names are not allowed to end in '%1%'", drvExtension);
@@ -2043,7 +2043,7 @@ string EvalState::copyPathToStore(PathSet & context, const Path & path)
 
 Path EvalState::coerceToPath(const Pos & pos, Value & v, PathSet & context)
 {
-    string path = coerceToString(pos, v, context, false, false).toOwned();
+    auto path = coerceToString(pos, v, context, false, false).toOwned();
     if (path == "" || path[0] != '/')
         throwEvalError(pos, "string '%1%' doesn't represent an absolute path", path);
     return path;
@@ -2213,11 +2213,11 @@ void EvalState::printStats()
                 for (auto & i : functionCalls) {
                     auto obj = list.object();
                     if (i.first->name.set())
-                        obj.attr("name", (const string &) i.first->name);
+                        obj.attr("name", (const std::string &) i.first->name);
                     else
                         obj.attr("name", nullptr);
                     if (i.first->pos) {
-                        obj.attr("file", (const string &) i.first->pos.file);
+                        obj.attr("file", (const std::string &) i.first->pos.file);
                         obj.attr("line", i.first->pos.line);
                         obj.attr("column", i.first->pos.column);
                     }
@@ -2229,7 +2229,7 @@ void EvalState::printStats()
                 for (auto & i : attrSelects) {
                     auto obj = list.object();
                     if (i.first) {
-                        obj.attr("file", (const string &) i.first.file);
+                        obj.attr("file", (const std::string &) i.first.file);
                         obj.attr("line", i.first.line);
                         obj.attr("column", i.first.column);
                     }
@@ -2246,7 +2246,7 @@ void EvalState::printStats()
 }
 
 
-string ExternalValueBase::coerceToString(const Pos & pos, PathSet & context, bool copyMore, bool copyToStore) const
+std::string ExternalValueBase::coerceToString(const Pos & pos, PathSet & context, bool copyMore, bool copyToStore) const
 {
     throw TypeError({
         .msg = hintfmt("cannot coerce %1% to a string", showType()),
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index ce5a16e11..1f0e97b2e 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -150,7 +150,7 @@ public:
         const Pos & pos
     );
 
-    void addToSearchPath(const string & s);
+    void addToSearchPath(const std::string & s);
 
     SearchPath getSearchPath() { return searchPath; }
 
@@ -251,7 +251,7 @@ public:
        set with attribute `type = "derivation"'). */
     bool isDerivation(Value & v);
 
-    std::optional<string> tryAttrsToString(const Pos & pos, Value & v,
+    std::optional<std::string> tryAttrsToString(const Pos & pos, Value & v,
         PathSet & context, bool coerceMore = false, bool copyToStore = true);
 
     /* String coercion.  Converts strings, paths and derivations to a
@@ -262,7 +262,7 @@ public:
         bool coerceMore = false, bool copyToStore = true,
         bool canonicalizePath = true);
 
-    string copyPathToStore(PathSet & context, const Path & path);
+    std::string copyPathToStore(PathSet & context, const Path & path);
 
     /* Path coercion.  Converts strings, paths and derivations to a
        path.  The result is guaranteed to be a canonicalised, absolute
@@ -284,18 +284,18 @@ private:
 
     void createBaseEnv();
 
-    Value * addConstant(const string & name, Value & v);
+    Value * addConstant(const std::string & name, Value & v);
 
-    void addConstant(const string & name, Value * v);
+    void addConstant(const std::string & name, Value * v);
 
-    Value * addPrimOp(const string & name,
+    Value * addPrimOp(const std::string & name,
         size_t arity, PrimOpFun primOp);
 
     Value * addPrimOp(PrimOp && primOp);
 
 public:
 
-    Value & getBuiltin(const string & name);
+    Value & getBuiltin(const std::string & name);
 
     struct Doc
     {
@@ -414,12 +414,12 @@ private:
 
 
 /* Return a string representing the type of the value `v'. */
-string showType(ValueType type);
-string showType(const Value & v);
+std::string_view showType(ValueType type);
+std::string showType(const Value & v);
 
 /* Decode a context string ‘!<name>!<path>’ into a pair <path,
    name>. */
-std::pair<string, string> decodeContext(std::string_view s);
+std::pair<std::string, std::string> decodeContext(std::string_view s);
 
 /* If `path' refers to a directory, then append "/default.nix". */
 Path resolveExprPath(Path path);
diff --git a/src/libexpr/flake/flake.cc b/src/libexpr/flake/flake.cc
index 6e3fa41f7..ad0881641 100644
--- a/src/libexpr/flake/flake.cc
+++ b/src/libexpr/flake/flake.cc
@@ -254,7 +254,7 @@ static Flake getFlake(
         for (auto & setting : *nixConfig->value->attrs) {
             forceTrivialValue(state, *setting.value, *setting.pos);
             if (setting.value->type() == nString)
-                flake.config.settings.insert({setting.name, string(state.forceStringNoCtx(*setting.value, *setting.pos))});
+                flake.config.settings.insert({setting.name, std::string(state.forceStringNoCtx(*setting.value, *setting.pos))});
             else if (setting.value->type() == nPath) {
                 PathSet emptyContext = {};
                 flake.config.settings.emplace(
@@ -707,7 +707,7 @@ static void prim_getFlake(EvalState & state, const Pos & pos, Value * * args, Va
 {
     state.requireExperimentalFeatureOnEvaluation(Xp::Flakes, "builtins.getFlake", pos);
 
-    string flakeRefS(state.forceStringNoCtx(*args[0], pos));
+    std::string flakeRefS(state.forceStringNoCtx(*args[0], pos));
     auto flakeRef = parseFlakeRef(flakeRefS, {}, true);
     if (evalSettings.pureEval && !flakeRef.input.isLocked())
         throw Error("cannot call 'getFlake' on unlocked flake reference '%s', at %s (use --impure to override)", flakeRefS, pos);
diff --git a/src/libexpr/get-drvs.cc b/src/libexpr/get-drvs.cc
index 167fb5fa9..8393e4225 100644
--- a/src/libexpr/get-drvs.cc
+++ b/src/libexpr/get-drvs.cc
@@ -11,8 +11,8 @@
 namespace nix {
 
 
-DrvInfo::DrvInfo(EvalState & state, const string & attrPath, Bindings * attrs)
-    : state(&state), attrs(attrs), attrPath(attrPath)
+DrvInfo::DrvInfo(EvalState & state, std::string attrPath, Bindings * attrs)
+    : state(&state), attrs(attrs), attrPath(std::move(attrPath))
 {
 }
 
@@ -47,7 +47,7 @@ DrvInfo::DrvInfo(EvalState & state, ref<Store> store, const std::string & drvPat
 }
 
 
-string DrvInfo::queryName() const
+std::string DrvInfo::queryName() const
 {
     if (name == "" && attrs) {
         auto i = attrs->find(state->sName);
@@ -58,7 +58,7 @@ string DrvInfo::queryName() const
 }
 
 
-string DrvInfo::querySystem() const
+std::string DrvInfo::querySystem() const
 {
     if (system == "" && attrs) {
         auto i = attrs->find(state->sSystem);
@@ -68,7 +68,7 @@ string DrvInfo::querySystem() const
 }
 
 
-string DrvInfo::queryDrvPath() const
+std::string DrvInfo::queryDrvPath() const
 {
     if (drvPath == "" && attrs) {
         Bindings::iterator i = attrs->find(state->sDrvPath);
@@ -79,7 +79,7 @@ string DrvInfo::queryDrvPath() const
 }
 
 
-string DrvInfo::queryOutPath() const
+std::string DrvInfo::queryOutPath() const
 {
     if (!outPath && attrs) {
         Bindings::iterator i = attrs->find(state->sOutPath);
@@ -104,7 +104,7 @@ DrvInfo::Outputs DrvInfo::queryOutputs(bool onlyOutputsToInstall)
             /* For each output... */
             for (auto elem : i->value->listItems()) {
                 /* Evaluate the corresponding set. */
-                string name(state->forceStringNoCtx(*elem, *i->pos));
+                std::string name(state->forceStringNoCtx(*elem, *i->pos));
                 Bindings::iterator out = attrs->find(state->symbols.create(name));
                 if (out == attrs->end()) continue; // FIXME: throw error?
                 state->forceAttrs(*out->value, *i->pos);
@@ -138,7 +138,7 @@ DrvInfo::Outputs DrvInfo::queryOutputs(bool onlyOutputsToInstall)
 }
 
 
-string DrvInfo::queryOutputName() const
+std::string DrvInfo::queryOutputName() const
 {
     if (outputName == "" && attrs) {
         Bindings::iterator i = attrs->find(state->sOutputName);
@@ -190,7 +190,7 @@ bool DrvInfo::checkMeta(Value & v)
 }
 
 
-Value * DrvInfo::queryMeta(const string & name)
+Value * DrvInfo::queryMeta(const std::string & name)
 {
     if (!getMeta()) return 0;
     Bindings::iterator a = meta->find(state->symbols.create(name));
@@ -199,7 +199,7 @@ Value * DrvInfo::queryMeta(const string & name)
 }
 
 
-string DrvInfo::queryMetaString(const string & name)
+std::string DrvInfo::queryMetaString(const std::string & name)
 {
     Value * v = queryMeta(name);
     if (!v || v->type() != nString) return "";
@@ -207,7 +207,7 @@ string DrvInfo::queryMetaString(const string & name)
 }
 
 
-NixInt DrvInfo::queryMetaInt(const string & name, NixInt def)
+NixInt DrvInfo::queryMetaInt(const std::string & name, NixInt def)
 {
     Value * v = queryMeta(name);
     if (!v) return def;
@@ -221,7 +221,7 @@ NixInt DrvInfo::queryMetaInt(const string & name, NixInt def)
     return def;
 }
 
-NixFloat DrvInfo::queryMetaFloat(const string & name, NixFloat def)
+NixFloat DrvInfo::queryMetaFloat(const std::string & name, NixFloat def)
 {
     Value * v = queryMeta(name);
     if (!v) return def;
@@ -236,7 +236,7 @@ NixFloat DrvInfo::queryMetaFloat(const string & name, NixFloat def)
 }
 
 
-bool DrvInfo::queryMetaBool(const string & name, bool def)
+bool DrvInfo::queryMetaBool(const std::string & name, bool def)
 {
     Value * v = queryMeta(name);
     if (!v) return def;
@@ -251,7 +251,7 @@ bool DrvInfo::queryMetaBool(const string & name, bool def)
 }
 
 
-void DrvInfo::setMeta(const string & name, Value * v)
+void DrvInfo::setMeta(const std::string & name, Value * v)
 {
     getMeta();
     auto attrs = state->buildBindings(1 + (meta ? meta->size() : 0));
@@ -274,7 +274,7 @@ typedef std::set<Bindings *> Done;
    The result boolean indicates whether it makes sense
    for the caller to recursively search for derivations in `v'. */
 static bool getDerivation(EvalState & state, Value & v,
-    const string & attrPath, DrvInfos & drvs, Done & done,
+    const std::string & attrPath, DrvInfos & drvs, Done & done,
     bool ignoreAssertionFailures)
 {
     try {
@@ -311,7 +311,7 @@ std::optional<DrvInfo> getDerivation(EvalState & state, Value & v,
 }
 
 
-static string addToPath(const string & s1, const string & s2)
+static std::string addToPath(const std::string & s1, const std::string & s2)
 {
     return s1.empty() ? s2 : s1 + "." + s2;
 }
@@ -321,7 +321,7 @@ static std::regex attrRegex("[A-Za-z_][A-Za-z0-9-_+]*");
 
 
 static void getDerivations(EvalState & state, Value & vIn,
-    const string & pathPrefix, Bindings & autoArgs,
+    const std::string & pathPrefix, Bindings & autoArgs,
     DrvInfos & drvs, Done & done,
     bool ignoreAssertionFailures)
 {
@@ -346,7 +346,7 @@ static void getDerivations(EvalState & state, Value & vIn,
             debug("evaluating attribute '%1%'", i->name);
             if (!std::regex_match(std::string(i->name), attrRegex))
                 continue;
-            string pathPrefix2 = addToPath(pathPrefix, i->name);
+            std::string pathPrefix2 = addToPath(pathPrefix, i->name);
             if (combineChannels)
                 getDerivations(state, *i->value, pathPrefix2, autoArgs, drvs, done, ignoreAssertionFailures);
             else if (getDerivation(state, *i->value, pathPrefix2, drvs, done, ignoreAssertionFailures)) {
@@ -364,7 +364,7 @@ static void getDerivations(EvalState & state, Value & vIn,
 
     else if (v.type() == nList) {
         for (auto [n, elem] : enumerate(v.listItems())) {
-            string pathPrefix2 = addToPath(pathPrefix, fmt("%d", n));
+            std::string pathPrefix2 = addToPath(pathPrefix, fmt("%d", n));
             if (getDerivation(state, *elem, pathPrefix2, drvs, done, ignoreAssertionFailures))
                 getDerivations(state, *elem, pathPrefix2, autoArgs, drvs, done, ignoreAssertionFailures);
         }
@@ -374,7 +374,7 @@ static void getDerivations(EvalState & state, Value & vIn,
 }
 
 
-void getDerivations(EvalState & state, Value & v, const string & pathPrefix,
+void getDerivations(EvalState & state, Value & v, const std::string & pathPrefix,
     Bindings & autoArgs, DrvInfos & drvs, bool ignoreAssertionFailures)
 {
     Done done;
diff --git a/src/libexpr/get-drvs.hh b/src/libexpr/get-drvs.hh
index 128354682..d13847785 100644
--- a/src/libexpr/get-drvs.hh
+++ b/src/libexpr/get-drvs.hh
@@ -12,16 +12,16 @@ namespace nix {
 struct DrvInfo
 {
 public:
-    typedef std::map<string, Path> Outputs;
+    typedef std::map<std::string, Path> Outputs;
 
 private:
     EvalState * state;
 
-    mutable string name;
-    mutable string system;
-    mutable string drvPath;
-    mutable std::optional<string> outPath;
-    mutable string outputName;
+    mutable std::string name;
+    mutable std::string system;
+    mutable std::string drvPath;
+    mutable std::optional<std::string> outPath;
+    mutable std::string outputName;
     Outputs outputs;
 
     bool failed = false; // set if we get an AssertionError
@@ -33,36 +33,36 @@ private:
     bool checkMeta(Value & v);
 
 public:
-    string attrPath; /* path towards the derivation */
+    std::string attrPath; /* path towards the derivation */
 
     DrvInfo(EvalState & state) : state(&state) { };
-    DrvInfo(EvalState & state, const string & attrPath, Bindings * attrs);
+    DrvInfo(EvalState & state, std::string attrPath, Bindings * attrs);
     DrvInfo(EvalState & state, ref<Store> store, const std::string & drvPathWithOutputs);
 
-    string queryName() const;
-    string querySystem() const;
-    string queryDrvPath() const;
-    string queryOutPath() const;
-    string queryOutputName() const;
+    std::string queryName() const;
+    std::string querySystem() const;
+    std::string queryDrvPath() const;
+    std::string queryOutPath() const;
+    std::string queryOutputName() const;
     /** Return the list of outputs. The "outputs to install" are determined by `meta.outputsToInstall`. */
     Outputs queryOutputs(bool onlyOutputsToInstall = false);
 
     StringSet queryMetaNames();
-    Value * queryMeta(const string & name);
-    string queryMetaString(const string & name);
-    NixInt queryMetaInt(const string & name, NixInt def);
-    NixFloat queryMetaFloat(const string & name, NixFloat def);
-    bool queryMetaBool(const string & name, bool def);
-    void setMeta(const string & name, Value * v);
+    Value * queryMeta(const std::string & name);
+    std::string queryMetaString(const std::string & name);
+    NixInt queryMetaInt(const std::string & name, NixInt def);
+    NixFloat queryMetaFloat(const std::string & name, NixFloat def);
+    bool queryMetaBool(const std::string & name, bool def);
+    void setMeta(const std::string & name, Value * v);
 
     /*
     MetaInfo queryMetaInfo(EvalState & state) const;
     MetaValue queryMetaInfo(EvalState & state, const string & name) const;
     */
 
-    void setName(const string & s) { name = s; }
-    void setDrvPath(const string & s) { drvPath = s; }
-    void setOutPath(const string & s) { outPath = s; }
+    void setName(const std::string & s) { name = s; }
+    void setDrvPath(const std::string & s) { drvPath = s; }
+    void setOutPath(const std::string & s) { outPath = s; }
 
     void setFailed() { failed = true; };
     bool hasFailed() { return failed; };
@@ -81,7 +81,7 @@ typedef std::list<DrvInfo> DrvInfos;
 std::optional<DrvInfo> getDerivation(EvalState & state,
     Value & v, bool ignoreAssertionFailures);
 
-void getDerivations(EvalState & state, Value & v, const string & pathPrefix,
+void getDerivations(EvalState & state, Value & v, const std::string & pathPrefix,
     Bindings & autoArgs, DrvInfos & drvs,
     bool ignoreAssertionFailures);
 
diff --git a/src/libexpr/nixexpr.cc b/src/libexpr/nixexpr.cc
index 27ea0f2ad..a2def65a6 100644
--- a/src/libexpr/nixexpr.cc
+++ b/src/libexpr/nixexpr.cc
@@ -16,10 +16,10 @@ std::ostream & operator << (std::ostream & str, const Expr & e)
     return str;
 }
 
-static void showString(std::ostream & str, const string & s)
+static void showString(std::ostream & str, std::string_view s)
 {
     str << '"';
-    for (auto c : (string) s)
+    for (auto c : s)
         if (c == '"' || c == '\\' || c == '$') str << "\\" << c;
         else if (c == '\n') str << "\\n";
         else if (c == '\r') str << "\\r";
@@ -28,7 +28,7 @@ static void showString(std::ostream & str, const string & s)
     str << '"';
 }
 
-static void showId(std::ostream & str, const string & s)
+static void showId(std::ostream & str, std::string_view s)
 {
     if (s.empty())
         str << "\"\"";
@@ -218,7 +218,7 @@ std::ostream & operator << (std::ostream & str, const Pos & pos)
         auto f = format(ANSI_BOLD "%1%" ANSI_NORMAL ":%2%:%3%");
         switch (pos.origin) {
             case foFile:
-                f % (string) pos.file;
+                f % (const std::string &) pos.file;
                 break;
             case foStdin:
             case foString:
@@ -234,7 +234,7 @@ std::ostream & operator << (std::ostream & str, const Pos & pos)
 }
 
 
-string showAttrPath(const AttrPath & attrPath)
+std::string showAttrPath(const AttrPath & attrPath)
 {
     std::ostringstream out;
     bool first = true;
@@ -468,9 +468,9 @@ void ExprLambda::setName(Symbol & name)
 }
 
 
-string ExprLambda::showNamePos() const
+std::string ExprLambda::showNamePos() const
 {
-    return (format("%1% at %2%") % (name.set() ? "'" + (string) name + "'" : "anonymous function") % pos).str();
+    return fmt("%1% at %2%", name.set() ? "'" + (std::string) name + "'" : "anonymous function", pos);
 }
 
 
diff --git a/src/libexpr/nixexpr.hh b/src/libexpr/nixexpr.hh
index e7f717eba..12b54b8eb 100644
--- a/src/libexpr/nixexpr.hh
+++ b/src/libexpr/nixexpr.hh
@@ -26,18 +26,21 @@ struct Pos
     FileOrigin origin;
     Symbol file;
     unsigned int line, column;
-    Pos() : origin(foString), line(0), column(0) { };
+
+    Pos() : origin(foString), line(0), column(0) { }
     Pos(FileOrigin origin, const Symbol & file, unsigned int line, unsigned int column)
-        : origin(origin), file(file), line(line), column(column) { };
+        : origin(origin), file(file), line(line), column(column) { }
+
     operator bool() const
     {
         return line != 0;
     }
+
     bool operator < (const Pos & p2) const
     {
         if (!line) return p2.line;
         if (!p2.line) return false;
-        int d = ((string) file).compare((string) p2.file);
+        int d = ((const std::string &) file).compare((const std::string &) p2.file);
         if (d < 0) return true;
         if (d > 0) return false;
         if (line < p2.line) return true;
@@ -68,7 +71,7 @@ struct AttrName
 
 typedef std::vector<AttrName> AttrPath;
 
-string showAttrPath(const AttrPath & attrPath);
+std::string showAttrPath(const AttrPath & attrPath);
 
 
 /* Abstract syntax of Nix expressions. */
@@ -110,7 +113,7 @@ struct ExprFloat : Expr
 
 struct ExprString : Expr
 {
-    string s;
+    std::string s;
     Value v;
     ExprString(std::string s) : s(std::move(s)) { v.mkString(this->s.data()); };
     COMMON_METHODS
@@ -119,9 +122,9 @@ struct ExprString : Expr
 
 struct ExprPath : Expr
 {
-    string s;
+    std::string s;
     Value v;
-    ExprPath(const string & s) : s(s) { v.mkPath(this->s.c_str()); };
+    ExprPath(std::string s) : s(std::move(s)) { v.mkPath(this->s.c_str()); };
     COMMON_METHODS
     Value * maybeThunk(EvalState & state, Env & env);
 };
@@ -249,7 +252,7 @@ struct ExprLambda : Expr
     {
     };
     void setName(Symbol & name);
-    string showNamePos() const;
+    std::string showNamePos() const;
     inline bool hasFormals() const { return formals != nullptr; }
     COMMON_METHODS
 };
diff --git a/src/libexpr/parser.y b/src/libexpr/parser.y
index e1d177c1f..919b9cfae 100644
--- a/src/libexpr/parser.y
+++ b/src/libexpr/parser.y
@@ -244,7 +244,7 @@ static Expr * stripIndentation(const Pos & pos, SymbolTable & symbols,
         es2->emplace_back(i->first, e);
     };
     const auto trimString = [&] (const StringToken & t) {
-        string s2;
+        std::string s2;
         for (size_t j = 0; j < t.l; ++j) {
             if (atStartOfLine) {
                 if (t.p[j] == ' ') {
@@ -268,9 +268,9 @@ static Expr * stripIndentation(const Pos & pos, SymbolTable & symbols,
         /* Remove the last line if it is empty and consists only of
            spaces. */
         if (n == 1) {
-            string::size_type p = s2.find_last_of('\n');
-            if (p != string::npos && s2.find_first_not_of(' ', p + 1) == string::npos)
-                s2 = string(s2, 0, p + 1);
+            std::string::size_type p = s2.find_last_of('\n');
+            if (p != std::string::npos && s2.find_first_not_of(' ', p + 1) == std::string::npos)
+                s2 = std::string(s2, 0, p + 1);
         }
 
         es2->emplace_back(i->first, new ExprString(s2));
@@ -466,7 +466,7 @@ expr_simple
       $$ = new ExprConcatStrings(CUR_POS, false, $2);
   }
   | SPATH {
-      string path($1.p + 1, $1.l - 2);
+      std::string path($1.p + 1, $1.l - 2);
       $$ = new ExprCall(CUR_POS,
           new ExprVar(data->symbols.create("__findFile")),
           {new ExprVar(data->symbols.create("__nixPath")),
@@ -479,7 +479,7 @@ expr_simple
               .msg = hintfmt("URL literals are disabled"),
               .errPos = CUR_POS
           });
-      $$ = new ExprString(string($1));
+      $$ = new ExprString(std::string($1));
   }
   | '(' expr ')' { $$ = $2; }
   /* Let expressions `let {..., body = ...}' are just desugared
@@ -494,19 +494,19 @@ expr_simple
   ;
 
 string_parts
-  : STR { $$ = new ExprString(string($1)); }
+  : STR { $$ = new ExprString(std::string($1)); }
   | string_parts_interpolated { $$ = new ExprConcatStrings(CUR_POS, true, $1); }
   | { $$ = new ExprString(""); }
   ;
 
 string_parts_interpolated
   : string_parts_interpolated STR
-  { $$ = $1; $1->emplace_back(makeCurPos(@2, data), new ExprString(string($2))); }
+  { $$ = $1; $1->emplace_back(makeCurPos(@2, data), new ExprString(std::string($2))); }
   | string_parts_interpolated DOLLAR_CURLY expr '}' { $$ = $1; $1->emplace_back(makeCurPos(@2, data), $3); }
   | DOLLAR_CURLY expr '}' { $$ = new std::vector<std::pair<Pos, Expr *> >; $$->emplace_back(makeCurPos(@1, data), $2); }
   | STR DOLLAR_CURLY expr '}' {
       $$ = new std::vector<std::pair<Pos, Expr *> >;
-      $$->emplace_back(makeCurPos(@1, data), new ExprString(string($1)));
+      $$->emplace_back(makeCurPos(@1, data), new ExprString(std::string($1)));
       $$->emplace_back(makeCurPos(@2, data), $3);
     }
   ;
@@ -520,7 +520,7 @@ path_start
     $$ = new ExprPath(path);
   }
   | HPATH {
-    Path path(getHome() + string($1.p + 1, $1.l - 1));
+    Path path(getHome() + std::string($1.p + 1, $1.l - 1));
     $$ = new ExprPath(path);
   }
   ;
@@ -738,16 +738,16 @@ Expr * EvalState::parseStdin()
 }
 
 
-void EvalState::addToSearchPath(const string & s)
+void EvalState::addToSearchPath(const std::string & s)
 {
     size_t pos = s.find('=');
-    string prefix;
+    std::string prefix;
     Path path;
-    if (pos == string::npos) {
+    if (pos == std::string::npos) {
         path = s;
     } else {
-        prefix = string(s, 0, pos);
-        path = string(s, pos + 1);
+        prefix = std::string(s, 0, pos);
+        path = std::string(s, pos + 1);
     }
 
     searchPath.emplace_back(prefix, path);
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index daf679a5a..aa22c3b61 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -141,7 +141,7 @@ static void mkOutputString(
     BindingsBuilder & attrs,
     const StorePath & drvPath,
     const BasicDerivation & drv,
-    const std::pair<string, DerivationOutput> & o)
+    const std::pair<std::string, DerivationOutput> & o)
 {
     auto optOutputPath = o.second.path(*state.store, drv.name, o.first);
     attrs.alloc(o.first).mkString(
@@ -314,7 +314,7 @@ void prim_importNative(EvalState & state, const Pos & pos, Value * * args, Value
 {
     auto path = realisePath(state, pos, *args[0]);
 
-    string sym(state.forceStringNoCtx(*args[1], pos));
+    std::string sym(state.forceStringNoCtx(*args[1], pos));
 
     void *handle = dlopen(path.c_str(), RTLD_LAZY | RTLD_LOCAL);
     if (!handle)
@@ -386,7 +386,7 @@ void prim_exec(EvalState & state, const Pos & pos, Value * * args, Value & v)
 static void prim_typeOf(EvalState & state, const Pos & pos, Value * * args, Value & v)
 {
     state.forceValue(*args[0], pos);
-    string t;
+    std::string t;
     switch (args[0]->type()) {
         case nInt: t = "int"; break;
         case nBool: t = "bool"; break;
@@ -707,7 +707,7 @@ static RegisterPrimOp primop_abort({
     .fun = [](EvalState & state, const Pos & pos, Value * * args, Value & v)
     {
         PathSet context;
-        string s = state.coerceToString(pos, *args[0], context).toOwned();
+        auto s = state.coerceToString(pos, *args[0], context).toOwned();
         throw Abort("evaluation aborted with the following error message: '%1%'", s);
     }
 });
@@ -725,7 +725,7 @@ static RegisterPrimOp primop_throw({
     .fun = [](EvalState & state, const Pos & pos, Value * * args, Value & v)
     {
       PathSet context;
-      string s = state.coerceToString(pos, *args[0], context).toOwned();
+      auto s = state.coerceToString(pos, *args[0], context).toOwned();
       throw ThrownError(s);
     }
 });
@@ -826,7 +826,7 @@ static RegisterPrimOp primop_tryEval({
 /* Return an environment variable.  Use with care. */
 static void prim_getEnv(EvalState & state, const Pos & pos, Value * * args, Value & v)
 {
-    string name(state.forceStringNoCtx(*args[0], pos));
+    std::string name(state.forceStringNoCtx(*args[0], pos));
     v.mkString(evalSettings.restrictEval || evalSettings.pureEval ? "" : getEnv(name).value_or(""));
 }
 
@@ -935,7 +935,7 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
         pos
     );
 
-    string drvName;
+    std::string drvName;
     Pos & posDrvName(*attr->pos);
     try {
         drvName = state.forceStringNoCtx(*attr->value, pos);
@@ -973,7 +973,7 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
 
     for (auto & i : args[0]->attrs->lexicographicOrder()) {
         if (i->name == state.sIgnoreNulls) continue;
-        const string & key = i->name;
+        const std::string & key = i->name;
         vomit("processing attribute '%1%'", key);
 
         auto handleHashMode = [&](const std::string_view s) {
@@ -1031,7 +1031,7 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
             else if (i->name == state.sArgs) {
                 state.forceList(*i->value, pos);
                 for (auto elem : i->value->listItems()) {
-                    string s = state.coerceToString(posDrvName, *elem, context, true).toOwned();
+                    auto s = state.coerceToString(posDrvName, *elem, context, true).toOwned();
                     drv.args.push_back(s);
                 }
             }
@@ -1118,7 +1118,7 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
 
         /* Handle derivation outputs of the form ‘!<name>!<path>’. */
         else if (path.at(0) == '!') {
-            std::pair<string, string> ctx = decodeContext(path);
+            auto ctx = decodeContext(path);
             drv.inputDrvs[state.store->parseStorePath(ctx.first)].insert(ctx.second);
         }
 
@@ -1440,8 +1440,8 @@ static RegisterPrimOp primop_dirOf({
 static void prim_readFile(EvalState & state, const Pos & pos, Value * * args, Value & v)
 {
     auto path = realisePath(state, pos, *args[0]);
-    string s = readFile(path);
-    if (s.find((char) 0) != string::npos)
+    auto s = readFile(path);
+    if (s.find((char) 0) != std::string::npos)
         throw Error("the contents of the file '%1%' cannot be represented as a Nix string", path);
     StorePathSet refs;
     if (state.store->isInStore(path)) {
@@ -1474,7 +1474,7 @@ static void prim_findFile(EvalState & state, const Pos & pos, Value * * args, Va
     for (auto v2 : args[0]->listItems()) {
         state.forceAttrs(*v2, pos);
 
-        string prefix;
+        std::string prefix;
         Bindings::iterator i = v2->attrs->find(state.sPrefix);
         if (i != v2->attrs->end())
             prefix = state.forceStringNoCtx(*i->value, pos);
@@ -1488,7 +1488,7 @@ static void prim_findFile(EvalState & state, const Pos & pos, Value * * args, Va
         );
 
         PathSet context;
-        string path = state.coerceToString(pos, *i->value, context, false, false).toOwned();
+        auto path = state.coerceToString(pos, *i->value, context, false, false).toOwned();
 
         try {
             auto rewrites = state.realiseContext(context);
@@ -1754,8 +1754,8 @@ static RegisterPrimOp primop_fromJSON({
 static void prim_toFile(EvalState & state, const Pos & pos, Value * * args, Value & v)
 {
     PathSet context;
-    string name(state.forceStringNoCtx(*args[0], pos));
-    string contents(state.forceString(*args[1], context, pos));
+    std::string name(state.forceStringNoCtx(*args[0], pos));
+    std::string contents(state.forceString(*args[1], context, pos));
 
     StorePathSet refs;
 
@@ -1863,7 +1863,7 @@ static RegisterPrimOp primop_toFile({
 static void addPath(
     EvalState & state,
     const Pos & pos,
-    const string & name,
+    const std::string & name,
     Path path,
     Value * filterFun,
     FileIngestionMethod method,
@@ -2016,14 +2016,14 @@ static void prim_path(EvalState & state, const Pos & pos, Value * * args, Value
 {
     state.forceAttrs(*args[0], pos);
     Path path;
-    string name;
+    std::string name;
     Value * filterFun = nullptr;
     auto method = FileIngestionMethod::Recursive;
     std::optional<Hash> expectedHash;
     PathSet context;
 
     for (auto & attr : *args[0]->attrs) {
-        const string & n(attr.name);
+        auto & n(attr.name);
         if (n == "path")
             path = state.coerceToPath(*attr.pos, *attr.value, context);
         else if (attr.name == state.sName)
@@ -3616,7 +3616,7 @@ static void prim_concatStringsSep(EvalState & state, const Pos & pos, Value * *
     auto sep = state.forceString(*args[0], context, pos);
     state.forceList(*args[1], pos);
 
-    string res;
+    std::string res;
     res.reserve((args[1]->listSize() + 32) * sep.size());
     bool first = true;
 
@@ -3649,12 +3649,12 @@ static void prim_replaceStrings(EvalState & state, const Pos & pos, Value * * ar
             .errPos = pos
         });
 
-    std::vector<string> from;
+    std::vector<std::string> from;
     from.reserve(args[0]->listSize());
     for (auto elem : args[0]->listItems())
         from.emplace_back(state.forceString(*elem, pos));
 
-    std::vector<std::pair<string, PathSet>> to;
+    std::vector<std::pair<std::string, PathSet>> to;
     to.reserve(args[1]->listSize());
     for (auto elem : args[1]->listItems()) {
         PathSet ctx;
@@ -3665,7 +3665,7 @@ static void prim_replaceStrings(EvalState & state, const Pos & pos, Value * * ar
     PathSet context;
     auto s = state.forceString(*args[2], context, pos);
 
-    string res;
+    std::string res;
     // Loops one past last character to handle the case where 'from' contains an empty string.
     for (size_t p = 0; p <= s.size(); ) {
         bool found = false;
diff --git a/src/libexpr/primops/context.cc b/src/libexpr/primops/context.cc
index 654251c23..3701bd442 100644
--- a/src/libexpr/primops/context.cc
+++ b/src/libexpr/primops/context.cc
@@ -37,7 +37,7 @@ static void prim_unsafeDiscardOutputDependency(EvalState & state, const Pos & po
 
     PathSet context2;
     for (auto & p : context)
-        context2.insert(p.at(0) == '=' ? string(p, 1) : p);
+        context2.insert(p.at(0) == '=' ? std::string(p, 1) : p);
 
     v.mkString(*s, context2);
 }
@@ -76,13 +76,13 @@ static void prim_getContext(EvalState & state, const Pos & pos, Value * * args,
     auto contextInfos = std::map<Path, ContextInfo>();
     for (const auto & p : context) {
         Path drv;
-        string output;
+        std::string output;
         const Path * path = &p;
         if (p.at(0) == '=') {
-            drv = string(p, 1);
+            drv = std::string(p, 1);
             path = &drv;
         } else if (p.at(0) == '!') {
-            std::pair<string, string> ctx = decodeContext(p);
+            std::pair<std::string, std::string> ctx = decodeContext(p);
             drv = ctx.first;
             output = ctx.second;
             path = &drv;
@@ -166,7 +166,7 @@ static void prim_appendContext(EvalState & state, const Pos & pos, Value * * arg
                         .errPos = *i.pos
                     });
                 }
-                context.insert("=" + string(i.name));
+                context.insert("=" + std::string(i.name));
             }
         }
 
diff --git a/src/libexpr/primops/fetchMercurial.cc b/src/libexpr/primops/fetchMercurial.cc
index c4e1a7bf0..b7f715859 100644
--- a/src/libexpr/primops/fetchMercurial.cc
+++ b/src/libexpr/primops/fetchMercurial.cc
@@ -62,7 +62,7 @@ static void prim_fetchMercurial(EvalState & state, const Pos & pos, Value * * ar
     fetchers::Attrs attrs;
     attrs.insert_or_assign("type", "hg");
     attrs.insert_or_assign("url", url.find("://") != std::string::npos ? url : "file://" + url);
-    attrs.insert_or_assign("name", string(name));
+    attrs.insert_or_assign("name", std::string(name));
     if (ref) attrs.insert_or_assign("ref", *ref);
     if (rev) attrs.insert_or_assign("rev", rev->gitRev());
     auto input = fetchers::Input::fromAttrs(std::move(attrs));
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index 7496104b6..f3e3e70d8 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -186,7 +186,7 @@ static void prim_fetchTree(EvalState & state, const Pos & pos, Value * * args, V
 static RegisterPrimOp primop_fetchTree("fetchTree", 1, prim_fetchTree);
 
 static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
-    const string & who, bool unpack, std::string name)
+    const std::string & who, bool unpack, std::string name)
 {
     std::optional<std::string> url;
     std::optional<Hash> expectedHash;
@@ -198,7 +198,7 @@ static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
         state.forceAttrs(*args[0], pos);
 
         for (auto & attr : *args[0]->attrs) {
-            string n(attr.name);
+            std::string n(attr.name);
             if (n == "url")
                 url = state.forceStringNoCtx(*attr.value, *attr.pos);
             else if (n == "sha256")
diff --git a/src/libexpr/primops/fromTOML.cc b/src/libexpr/primops/fromTOML.cc
index c0e858b61..dd4280030 100644
--- a/src/libexpr/primops/fromTOML.cc
+++ b/src/libexpr/primops/fromTOML.cc
@@ -9,7 +9,7 @@ static void prim_fromTOML(EvalState & state, const Pos & pos, Value * * args, Va
 {
     auto toml = state.forceStringNoCtx(*args[0], pos);
 
-    std::istringstream tomlStream(string{toml});
+    std::istringstream tomlStream(std::string{toml});
 
     std::function<void(Value &, toml::value)> visit;
 
diff --git a/src/libexpr/value-to-xml.cc b/src/libexpr/value-to-xml.cc
index a9fb60b0e..afeaf5694 100644
--- a/src/libexpr/value-to-xml.cc
+++ b/src/libexpr/value-to-xml.cc
@@ -9,7 +9,7 @@
 namespace nix {
 
 
-static XMLAttrs singletonAttrs(const string & name, const string & value)
+static XMLAttrs singletonAttrs(const std::string & name, const std::string & value)
 {
     XMLAttrs attrs;
     attrs[name] = value;
diff --git a/src/libfetchers/mercurial.cc b/src/libfetchers/mercurial.cc
index 798369c7a..12cdecbc1 100644
--- a/src/libfetchers/mercurial.cc
+++ b/src/libfetchers/mercurial.cc
@@ -26,7 +26,7 @@ static RunOptions hgOptions(const Strings & args)
 }
 
 // runProgram wrapper that uses hgOptions instead of stock RunOptions.
-static string runHg(const Strings & args, const std::optional<std::string> & input = {})
+static std::string runHg(const Strings & args, const std::optional<std::string> & input = {})
 {
     RunOptions opts = hgOptions(args);
     opts.input = input;
@@ -254,7 +254,7 @@ struct MercurialInputScheme : InputScheme
                     runHg({ "pull", "-R", cacheDir, "--", actualUrl });
                 }
                 catch (ExecError & e) {
-                    string transJournal = cacheDir + "/.hg/store/journal";
+                    auto transJournal = cacheDir + "/.hg/store/journal";
                     /* hg throws "abandoned transaction" error only if this file exists */
                     if (pathExists(transJournal)) {
                         runHg({ "recover", "-R", cacheDir });
diff --git a/src/libmain/common-args.cc b/src/libmain/common-args.cc
index c43e9ebd2..12f5403ea 100644
--- a/src/libmain/common-args.cc
+++ b/src/libmain/common-args.cc
@@ -4,7 +4,7 @@
 
 namespace nix {
 
-MixCommonArgs::MixCommonArgs(const string & programName)
+MixCommonArgs::MixCommonArgs(const std::string & programName)
     : programName(programName)
 {
     addFlag({
diff --git a/src/libmain/common-args.hh b/src/libmain/common-args.hh
index 31bdf527a..25453b8c6 100644
--- a/src/libmain/common-args.hh
+++ b/src/libmain/common-args.hh
@@ -11,8 +11,8 @@ class MixCommonArgs : public virtual Args
 {
     void initialFlagsProcessed() override;
 public:
-    string programName;
-    MixCommonArgs(const string & programName);
+    std::string programName;
+    MixCommonArgs(const std::string & programName);
 protected:
     virtual void pluginsInited() {}
 };
diff --git a/src/libmain/shared.cc b/src/libmain/shared.cc
index f605184bb..47fc7ab2e 100644
--- a/src/libmain/shared.cc
+++ b/src/libmain/shared.cc
@@ -94,7 +94,7 @@ void printMissing(ref<Store> store, const StorePathSet & willBuild,
 }
 
 
-string getArg(const string & opt,
+std::string getArg(const std::string & opt,
     Strings::iterator & i, const Strings::iterator & end)
 {
     ++i;
@@ -227,6 +227,8 @@ LegacyArgs::LegacyArgs(const std::string & programName,
     std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg)
     : MixCommonArgs(programName), parseArg(parseArg)
 {
+    printError("FOO %s", programName);
+    
     addFlag({
         .longName = "no-build-output",
         .shortName = 'Q',
@@ -322,14 +324,14 @@ void parseCmdLine(int argc, char * * argv,
 }
 
 
-void parseCmdLine(const string & programName, const Strings & args,
+void parseCmdLine(const std::string & programName, const Strings & args,
     std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg)
 {
     LegacyArgs(programName, parseArg).parseCmdline(args);
 }
 
 
-void printVersion(const string & programName)
+void printVersion(const std::string & programName)
 {
     std::cout << format("%1% (Nix) %2%") % programName % nixVersion << std::endl;
     if (verbosity > lvlInfo) {
@@ -352,7 +354,7 @@ void printVersion(const string & programName)
 }
 
 
-void showManPage(const string & name)
+void showManPage(const std::string & name)
 {
     restoreProcessContext();
     setenv("MANPATH", settings.nixManDir.c_str(), 1);
@@ -361,13 +363,13 @@ void showManPage(const string & name)
 }
 
 
-int handleExceptions(const string & programName, std::function<void()> fun)
+int handleExceptions(const std::string & programName, std::function<void()> fun)
 {
     ReceiveInterrupts receiveInterrupts; // FIXME: need better place for this
 
     ErrorInfo::programName = baseNameOf(programName);
 
-    string error = ANSI_RED "error:" ANSI_NORMAL " ";
+    std::string error = ANSI_RED "error:" ANSI_NORMAL " ";
     try {
         try {
             fun();
@@ -407,7 +409,7 @@ RunPager::RunPager()
     if (!isatty(STDOUT_FILENO)) return;
     char * pager = getenv("NIX_PAGER");
     if (!pager) pager = getenv("PAGER");
-    if (pager && ((string) pager == "" || (string) pager == "cat")) return;
+    if (pager && ((std::string) pager == "" || (std::string) pager == "cat")) return;
 
     Pipe toPager;
     toPager.create();
diff --git a/src/libmain/shared.hh b/src/libmain/shared.hh
index ed012959b..0cc56d47d 100644
--- a/src/libmain/shared.hh
+++ b/src/libmain/shared.hh
@@ -22,7 +22,7 @@ public:
     virtual ~Exit();
 };
 
-int handleExceptions(const string & programName, std::function<void()> fun);
+int handleExceptions(const std::string & programName, std::function<void()> fun);
 
 /* Don't forget to call initPlugins() after settings are initialized! */
 void initNix();
@@ -30,10 +30,10 @@ void initNix();
 void parseCmdLine(int argc, char * * argv,
     std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg);
 
-void parseCmdLine(const string & programName, const Strings & args,
+void parseCmdLine(const std::string & programName, const Strings & args,
     std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg);
 
-void printVersion(const string & programName);
+void printVersion(const std::string & programName);
 
 /* Ugh.  No better place to put this. */
 void printGCWarning();
@@ -50,10 +50,10 @@ void printMissing(ref<Store> store, const StorePathSet & willBuild,
     const StorePathSet & willSubstitute, const StorePathSet & unknown,
     uint64_t downloadSize, uint64_t narSize, Verbosity lvl = lvlInfo);
 
-string getArg(const string & opt,
+std::string getArg(const std::string & opt,
     Strings::iterator & i, const Strings::iterator & end);
 
-template<class N> N getIntArg(const string & opt,
+template<class N> N getIntArg(const std::string & opt,
     Strings::iterator & i, const Strings::iterator & end, bool allowUnit)
 {
     ++i;
@@ -76,7 +76,7 @@ struct LegacyArgs : public MixCommonArgs
 
 
 /* Show the manual page for the specified program. */
-void showManPage(const string & name);
+void showManPage(const std::string & name);
 
 /* The constructor of this class starts a pager if stdout is a
    terminal and $PAGER is set. Stdout is redirected to the pager. */
@@ -96,7 +96,7 @@ extern volatile ::sig_atomic_t blockInt;
 
 /* GC helpers. */
 
-string showBytes(uint64_t bytes);
+std::string showBytes(uint64_t bytes);
 
 struct GCResults;
 
diff --git a/src/libstore/binary-cache-store.cc b/src/libstore/binary-cache-store.cc
index b3fd991a1..9226c4e19 100644
--- a/src/libstore/binary-cache-store.cc
+++ b/src/libstore/binary-cache-store.cc
@@ -385,8 +385,14 @@ void BinaryCacheStore::queryPathInfoUncached(const StorePath & storePath,
         }});
 }
 
-StorePath BinaryCacheStore::addToStore(const string & name, const Path & srcPath,
-    FileIngestionMethod method, HashType hashAlgo, PathFilter & filter, RepairFlag repair, const StorePathSet & references)
+StorePath BinaryCacheStore::addToStore(
+    std::string_view name,
+    const Path & srcPath,
+    FileIngestionMethod method,
+    HashType hashAlgo,
+    PathFilter & filter,
+    RepairFlag repair,
+    const StorePathSet & references)
 {
     /* FIXME: Make BinaryCacheStore::addToStoreCommon support
        non-recursive+sha256 so we can just use the default
@@ -418,8 +424,11 @@ StorePath BinaryCacheStore::addToStore(const string & name, const Path & srcPath
     })->path;
 }
 
-StorePath BinaryCacheStore::addTextToStore(const string & name, const string & s,
-    const StorePathSet & references, RepairFlag repair)
+StorePath BinaryCacheStore::addTextToStore(
+    std::string_view name,
+    std::string_view s,
+    const StorePathSet & references,
+    RepairFlag repair)
 {
     auto textHash = hashString(htSHA256, s);
     auto path = makeTextPath(name, textHash, references);
diff --git a/src/libstore/binary-cache-store.hh b/src/libstore/binary-cache-store.hh
index 5b5d064f3..9603a8caa 100644
--- a/src/libstore/binary-cache-store.hh
+++ b/src/libstore/binary-cache-store.hh
@@ -101,12 +101,20 @@ public:
     StorePath addToStoreFromDump(Source & dump, std::string_view name,
         FileIngestionMethod method, HashType hashAlgo, RepairFlag repair, const StorePathSet & references) override;
 
-    StorePath addToStore(const string & name, const Path & srcPath,
-        FileIngestionMethod method, HashType hashAlgo,
-        PathFilter & filter, RepairFlag repair, const StorePathSet & references) override;
+    StorePath addToStore(
+        std::string_view name,
+        const Path & srcPath,
+        FileIngestionMethod method,
+        HashType hashAlgo,
+        PathFilter & filter,
+        RepairFlag repair,
+        const StorePathSet & references) override;
 
-    StorePath addTextToStore(const string & name, const string & s,
-        const StorePathSet & references, RepairFlag repair) override;
+    StorePath addTextToStore(
+        std::string_view name,
+        std::string_view s,
+        const StorePathSet & references,
+        RepairFlag repair) override;
 
     void registerDrvOutput(const Realisation & info) override;
 
diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index 27f8c6257..95da1841d 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -116,7 +116,7 @@ DerivationGoal::~DerivationGoal()
 }
 
 
-string DerivationGoal::key()
+std::string DerivationGoal::key()
 {
     /* Ensure that derivations get built in order of their name,
        i.e. a derivation named "aardvark" always comes before
@@ -1013,7 +1013,7 @@ HookReply DerivationGoal::tryBuildHook()
 
         /* Read the first line of input, which should be a word indicating
            whether the hook wishes to perform the build. */
-        string reply;
+        std::string reply;
         while (true) {
             auto s = [&]() {
                 try {
@@ -1025,8 +1025,8 @@ HookReply DerivationGoal::tryBuildHook()
             }();
             if (handleJSONLogMessage(s, worker.act, worker.hook->activities, true))
                 ;
-            else if (string(s, 0, 2) == "# ") {
-                reply = string(s, 2);
+            else if (s.substr(0, 2) == "# ") {
+                reply = s.substr(2);
                 break;
             }
             else {
@@ -1140,10 +1140,10 @@ Path DerivationGoal::openLogFile()
         logDir = localStore->logDir;
     else
         logDir = settings.nixLogDir;
-    Path dir = fmt("%s/%s/%s/", logDir, LocalFSStore::drvsLogDir, string(baseName, 0, 2));
+    Path dir = fmt("%s/%s/%s/", logDir, LocalFSStore::drvsLogDir, baseName.substr(0, 2));
     createDirs(dir);
 
-    Path logFileName = fmt("%s/%s%s", dir, string(baseName, 2),
+    Path logFileName = fmt("%s/%s%s", dir, baseName.substr(2),
         settings.compressLog ? ".bz2" : "");
 
     fdLogFile = open(logFileName.c_str(), O_CREAT | O_WRONLY | O_TRUNC | O_CLOEXEC, 0666);
@@ -1176,7 +1176,7 @@ bool DerivationGoal::isReadDesc(int fd)
 }
 
 
-void DerivationGoal::handleChildOutput(int fd, const string & data)
+void DerivationGoal::handleChildOutput(int fd, std::string_view data)
 {
     if (isReadDesc(fd))
     {
diff --git a/src/libstore/build/derivation-goal.hh b/src/libstore/build/derivation-goal.hh
index e112542c7..d947482ef 100644
--- a/src/libstore/build/derivation-goal.hh
+++ b/src/libstore/build/derivation-goal.hh
@@ -145,7 +145,7 @@ struct DerivationGoal : public Goal
 
     void timedOut(Error && ex) override;
 
-    string key() override;
+    std::string key() override;
 
     void work() override;
 
@@ -200,7 +200,7 @@ struct DerivationGoal : public Goal
     virtual bool isReadDesc(int fd);
 
     /* Callback used by the worker to write to the log. */
-    void handleChildOutput(int fd, const string & data) override;
+    void handleChildOutput(int fd, std::string_view data) override;
     void handleEOF(int fd) override;
     void flushLine();
 
diff --git a/src/libstore/build/drv-output-substitution-goal.cc b/src/libstore/build/drv-output-substitution-goal.cc
index b9602e696..e6e810cdd 100644
--- a/src/libstore/build/drv-output-substitution-goal.cc
+++ b/src/libstore/build/drv-output-substitution-goal.cc
@@ -137,7 +137,7 @@ void DrvOutputSubstitutionGoal::finished()
     amDone(ecSuccess);
 }
 
-string DrvOutputSubstitutionGoal::key()
+std::string DrvOutputSubstitutionGoal::key()
 {
     /* "a$" ensures substitution goals happen before derivation
        goals. */
diff --git a/src/libstore/build/drv-output-substitution-goal.hh b/src/libstore/build/drv-output-substitution-goal.hh
index 67ae2624a..948dbda8f 100644
--- a/src/libstore/build/drv-output-substitution-goal.hh
+++ b/src/libstore/build/drv-output-substitution-goal.hh
@@ -51,7 +51,7 @@ public:
 
     void timedOut(Error && ex) override { abort(); };
 
-    string key() override;
+    std::string key() override;
 
     void work() override;
     void handleEOF(int fd) override;
diff --git a/src/libstore/build/goal.cc b/src/libstore/build/goal.cc
index 7c985128b..d2420b107 100644
--- a/src/libstore/build/goal.cc
+++ b/src/libstore/build/goal.cc
@@ -5,8 +5,8 @@ namespace nix {
 
 
 bool CompareGoalPtrs::operator() (const GoalPtr & a, const GoalPtr & b) const {
-    string s1 = a->key();
-    string s2 = b->key();
+    std::string s1 = a->key();
+    std::string s2 = b->key();
     return s1 < s2;
 }
 
diff --git a/src/libstore/build/goal.hh b/src/libstore/build/goal.hh
index 0db0c1938..68e08bdf9 100644
--- a/src/libstore/build/goal.hh
+++ b/src/libstore/build/goal.hh
@@ -50,7 +50,7 @@ struct Goal : public std::enable_shared_from_this<Goal>
     unsigned int nrIncompleteClosure;
 
     /* Name of this goal for debugging purposes. */
-    string name;
+    std::string name;
 
     /* Whether the goal is finished. */
     ExitCode exitCode;
@@ -75,7 +75,7 @@ struct Goal : public std::enable_shared_from_this<Goal>
 
     virtual void waiteeDone(GoalPtr waitee, ExitCode result);
 
-    virtual void handleChildOutput(int fd, const string & data)
+    virtual void handleChildOutput(int fd, std::string_view data)
     {
         abort();
     }
@@ -87,7 +87,7 @@ struct Goal : public std::enable_shared_from_this<Goal>
 
     void trace(const FormatOrString & fs);
 
-    string getName()
+    std::string getName()
     {
         return name;
     }
@@ -97,7 +97,7 @@ struct Goal : public std::enable_shared_from_this<Goal>
        by the worker (important!), etc. */
     virtual void timedOut(Error && ex) = 0;
 
-    virtual string key() = 0;
+    virtual std::string key() = 0;
 
     void amDone(ExitCode result, std::optional<Error> ex = {});
 
diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index 8861d2c7b..220f80602 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -481,12 +481,12 @@ void LocalDerivationGoal::startBuilder()
            temporary build directory.  The text files have the format used
            by `nix-store --register-validity'.  However, the deriver
            fields are left empty. */
-        string s = get(drv->env, "exportReferencesGraph").value_or("");
+        auto s = get(drv->env, "exportReferencesGraph").value_or("");
         Strings ss = tokenizeString<Strings>(s);
         if (ss.size() % 2 != 0)
             throw BuildError("odd number of tokens in 'exportReferencesGraph': '%1%'", s);
         for (Strings::iterator i = ss.begin(); i != ss.end(); ) {
-            string fileName = *i++;
+            auto fileName = *i++;
             static std::regex regex("[A-Za-z_][A-Za-z0-9_.-]*");
             if (!std::regex_match(fileName, regex))
                 throw Error("invalid file name '%s' in 'exportReferencesGraph'", fileName);
@@ -517,10 +517,10 @@ void LocalDerivationGoal::startBuilder()
                 i.pop_back();
             }
             size_t p = i.find('=');
-            if (p == string::npos)
+            if (p == std::string::npos)
                 dirsInChroot[i] = {i, optional};
             else
-                dirsInChroot[string(i, 0, p)] = {string(i, p + 1), optional};
+                dirsInChroot[i.substr(0, p)] = {i.substr(p + 1), optional};
         }
         dirsInChroot[tmpDirInSandbox] = tmpDir;
 
@@ -671,9 +671,10 @@ void LocalDerivationGoal::startBuilder()
         auto state = stBegin;
         auto lines = runProgram(settings.preBuildHook, false, args);
         auto lastPos = std::string::size_type{0};
-        for (auto nlPos = lines.find('\n'); nlPos != string::npos;
-                nlPos = lines.find('\n', lastPos)) {
-            auto line = std::string{lines, lastPos, nlPos - lastPos};
+        for (auto nlPos = lines.find('\n'); nlPos != std::string::npos;
+                nlPos = lines.find('\n', lastPos))
+        {
+            auto line = lines.substr(lastPos, nlPos - lastPos);
             lastPos = nlPos + 1;
             if (state == stBegin) {
                 if (line == "extra-sandbox-paths" || line == "extra-chroot-dirs") {
@@ -686,10 +687,10 @@ void LocalDerivationGoal::startBuilder()
                     state = stBegin;
                 } else {
                     auto p = line.find('=');
-                    if (p == string::npos)
+                    if (p == std::string::npos)
                         dirsInChroot[line] = line;
                     else
-                        dirsInChroot[string(line, 0, p)] = string(line, p + 1);
+                        dirsInChroot[line.substr(0, p)] = line.substr(p + 1);
                 }
             }
         }
@@ -941,7 +942,7 @@ void LocalDerivationGoal::startBuilder()
     /* Check if setting up the build environment failed. */
     std::vector<std::string> msgs;
     while (true) {
-        string msg = [&]() {
+        std::string msg = [&]() {
             try {
                 return readLine(builderOut.readSide.get());
             } catch (Error & e) {
@@ -953,8 +954,8 @@ void LocalDerivationGoal::startBuilder()
                 throw;
             }
         }();
-        if (string(msg, 0, 1) == "\2") break;
-        if (string(msg, 0, 1) == "\1") {
+        if (msg.substr(0, 1) == "\2") break;
+        if (msg.substr(0, 1) == "\1") {
             FdSource source(builderOut.readSide.get());
             auto ex = readError(source);
             ex.addTrace({}, "while setting up the build environment");
@@ -990,7 +991,7 @@ void LocalDerivationGoal::initTmpDir() {
                 env[i.first] = i.second;
             } else {
                 auto hash = hashString(htSHA256, i.first);
-                string fn = ".attr-" + hash.to_string(Base32, false);
+                std::string fn = ".attr-" + hash.to_string(Base32, false);
                 Path p = tmpDir + "/" + fn;
                 writeFile(p, rewriteStrings(i.second, inputRewrites));
                 chownToBuilder(p);
@@ -1081,7 +1082,7 @@ void LocalDerivationGoal::writeStructuredAttrs()
         for (auto & [i, v] : json["outputs"].get<nlohmann::json::object_t>()) {
             /* The placeholder must have a rewrite, so we use it to cover both the
                cases where we know or don't know the output path ahead of time. */
-            rewritten[i] = rewriteStrings(v, inputRewrites);
+            rewritten[i] = rewriteStrings((std::string) v, inputRewrites);
         }
 
         json["outputs"] = rewritten;
@@ -1187,10 +1188,14 @@ struct RestrictedStore : public virtual RestrictedStoreConfig, public virtual Lo
     std::optional<StorePath> queryPathFromHashPart(const std::string & hashPart) override
     { throw Error("queryPathFromHashPart"); }
 
-    StorePath addToStore(const string & name, const Path & srcPath,
-        FileIngestionMethod method = FileIngestionMethod::Recursive, HashType hashAlgo = htSHA256,
-        PathFilter & filter = defaultPathFilter, RepairFlag repair = NoRepair,
-        const StorePathSet & references = StorePathSet()) override
+    StorePath addToStore(
+        std::string_view name,
+        const Path & srcPath,
+        FileIngestionMethod method,
+        HashType hashAlgo,
+        PathFilter & filter,
+        RepairFlag repair,
+        const StorePathSet & references) override
     { throw Error("addToStore"); }
 
     void addToStore(const ValidPathInfo & info, Source & narSource,
@@ -1200,17 +1205,24 @@ struct RestrictedStore : public virtual RestrictedStoreConfig, public virtual Lo
         goal.addDependency(info.path);
     }
 
-    StorePath addTextToStore(const string & name, const string & s,
-        const StorePathSet & references, RepairFlag repair = NoRepair) override
+    StorePath addTextToStore(
+        std::string_view name,
+        std::string_view s,
+        const StorePathSet & references,
+        RepairFlag repair = NoRepair) override
     {
         auto path = next->addTextToStore(name, s, references, repair);
         goal.addDependency(path);
         return path;
     }
 
-    StorePath addToStoreFromDump(Source & dump, std::string_view name,
-        FileIngestionMethod method = FileIngestionMethod::Recursive, HashType hashAlgo = htSHA256, RepairFlag repair = NoRepair,
-        const StorePathSet & references = StorePathSet()) override
+    StorePath addToStoreFromDump(
+        Source & dump,
+        std::string_view name,
+        FileIngestionMethod method,
+        HashType hashAlgo,
+        RepairFlag repair,
+        const StorePathSet & references) override
     {
         auto path = next->addToStoreFromDump(dump, name, method, hashAlgo, repair, references);
         goal.addDependency(path);
@@ -1992,7 +2004,7 @@ void LocalDerivationGoal::runChild()
             args.push_back(rewriteStrings(i, inputRewrites));
 
         /* Indicate that we managed to set up the build environment. */
-        writeFull(STDERR_FILENO, string("\2\n"));
+        writeFull(STDERR_FILENO, std::string("\2\n"));
 
         /* Execute the program.  This should not return. */
         if (drv->isBuiltin()) {
@@ -2010,7 +2022,7 @@ void LocalDerivationGoal::runChild()
                 else if (drv->builder == "builtin:unpack-channel")
                     builtinUnpackChannel(drv2);
                 else
-                    throw Error("unsupported builtin builder '%1%'", string(drv->builder, 8));
+                    throw Error("unsupported builtin builder '%1%'", drv->builder.substr(8));
                 _exit(0);
             } catch (std::exception & e) {
                 writeFull(STDERR_FILENO, e.what() + std::string("\n"));
@@ -2694,7 +2706,7 @@ void LocalDerivationGoal::checkOutputs(const std::map<Path, ValidPathInfo> & out
                     }
 
                 if (!badPaths.empty()) {
-                    string badPathsStr;
+                    std::string badPathsStr;
                     for (auto & i : badPaths) {
                         badPathsStr += "\n  ";
                         badPathsStr += worker.store.printStorePath(i);
diff --git a/src/libstore/build/local-derivation-goal.hh b/src/libstore/build/local-derivation-goal.hh
index bfdf91d89..2d1222d2f 100644
--- a/src/libstore/build/local-derivation-goal.hh
+++ b/src/libstore/build/local-derivation-goal.hh
@@ -58,7 +58,7 @@ struct LocalDerivationGoal : public DerivationGoal
     typedef map<Path, ChrootPath> DirsInChroot; // maps target path to source path
     DirsInChroot dirsInChroot;
 
-    typedef map<string, string> Environment;
+    typedef map<std::string, std::string> Environment;
     Environment env;
 
 #if __APPLE__
diff --git a/src/libstore/build/substitution-goal.cc b/src/libstore/build/substitution-goal.cc
index 5ecf1da7e..c1bb1941d 100644
--- a/src/libstore/build/substitution-goal.cc
+++ b/src/libstore/build/substitution-goal.cc
@@ -272,7 +272,7 @@ void PathSubstitutionGoal::finished()
 }
 
 
-void PathSubstitutionGoal::handleChildOutput(int fd, const string & data)
+void PathSubstitutionGoal::handleChildOutput(int fd, std::string_view data)
 {
 }
 
diff --git a/src/libstore/build/substitution-goal.hh b/src/libstore/build/substitution-goal.hh
index 70c806d23..d8399d2a8 100644
--- a/src/libstore/build/substitution-goal.hh
+++ b/src/libstore/build/substitution-goal.hh
@@ -59,7 +59,7 @@ public:
 
     void timedOut(Error && ex) override { abort(); };
 
-    string key() override
+    std::string key() override
     {
         /* "a$" ensures substitution goals happen before derivation
            goals. */
@@ -77,7 +77,7 @@ public:
     void finished();
 
     /* Callback used by the worker to write to the log. */
-    void handleChildOutput(int fd, const string & data) override;
+    void handleChildOutput(int fd, std::string_view data) override;
     void handleEOF(int fd) override;
 
     void cleanup() override;
diff --git a/src/libstore/build/worker.cc b/src/libstore/build/worker.cc
index 0a6108233..f72c1cc9c 100644
--- a/src/libstore/build/worker.cc
+++ b/src/libstore/build/worker.cc
@@ -394,7 +394,7 @@ void Worker::waitForInput()
                 } else {
                     printMsg(lvlVomit, "%1%: read %2% bytes",
                         goal->getName(), rd);
-                    string data((char *) buffer.data(), rd);
+                    std::string data((char *) buffer.data(), rd);
                     j->lastOutput = after;
                     goal->handleChildOutput(k, data);
                 }
diff --git a/src/libstore/builtins/buildenv.cc b/src/libstore/builtins/buildenv.cc
index e88fc687a..25d015cb9 100644
--- a/src/libstore/builtins/buildenv.cc
+++ b/src/libstore/builtins/buildenv.cc
@@ -123,7 +123,7 @@ void buildProfile(const Path & out, Packages && pkgs)
         createLinks(state, pkgDir, out, priority);
 
         try {
-            for (const auto & p : tokenizeString<std::vector<string>>(
+            for (const auto & p : tokenizeString<std::vector<std::string>>(
                     readFile(pkgDir + "/nix-support/propagated-user-env-packages"), " \n"))
                 if (!done.count(p))
                     postponed.insert(p);
@@ -161,7 +161,7 @@ void buildProfile(const Path & out, Packages && pkgs)
 
 void builtinBuildenv(const BasicDerivation & drv)
 {
-    auto getAttr = [&](const string & name) {
+    auto getAttr = [&](const std::string & name) {
         auto i = drv.env.find(name);
         if (i == drv.env.end()) throw Error("attribute '%s' missing", name);
         return i->second;
diff --git a/src/libstore/builtins/fetchurl.cc b/src/libstore/builtins/fetchurl.cc
index 4fb5d8a06..af3dfc409 100644
--- a/src/libstore/builtins/fetchurl.cc
+++ b/src/libstore/builtins/fetchurl.cc
@@ -16,7 +16,7 @@ void builtinFetchurl(const BasicDerivation & drv, const std::string & netrcData)
         writeFile(settings.netrcFile, netrcData, 0600);
     }
 
-    auto getAttr = [&](const string & name) {
+    auto getAttr = [&](const std::string & name) {
         auto i = drv.env.find(name);
         if (i == drv.env.end()) throw Error("attribute '%s' missing", name);
         return i->second;
diff --git a/src/libstore/builtins/unpack-channel.cc b/src/libstore/builtins/unpack-channel.cc
index d18e3ddaf..426d58a53 100644
--- a/src/libstore/builtins/unpack-channel.cc
+++ b/src/libstore/builtins/unpack-channel.cc
@@ -5,7 +5,7 @@ namespace nix {
 
 void builtinUnpackChannel(const BasicDerivation & drv)
 {
-    auto getAttr = [&](const string & name) {
+    auto getAttr = [&](const std::string & name) {
         auto i = drv.env.find(name);
         if (i == drv.env.end()) throw Error("attribute '%s' missing", name);
         return i->second;
diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index 1ddd1a4d5..2ba03f0dd 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -479,8 +479,8 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
     }
 
     case wopAddTextToStore: {
-        string suffix = readString(from);
-        string s = readString(from);
+        std::string suffix = readString(from);
+        std::string s = readString(from);
         auto refs = worker_proto::read(*store, from, Phantom<StorePathSet> {});
         logger->startWork();
         auto path = store->addTextToStore(suffix, s, refs, NoRepair);
@@ -698,8 +698,8 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         if (GET_PROTOCOL_MINOR(clientVersion) >= 12) {
             unsigned int n = readInt(from);
             for (unsigned int i = 0; i < n; i++) {
-                string name = readString(from);
-                string value = readString(from);
+                auto name = readString(from);
+                auto value = readString(from);
                 clientSettings.overrides.emplace(name, value);
             }
         }
diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index 40af6a775..a49be0057 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -82,7 +82,7 @@ bool derivationIsImpure(DerivationType dt) {
 
 bool BasicDerivation::isBuiltin() const
 {
-    return string(builder, 0, 8) == "builtin:";
+    return builder.substr(0, 8) == "builtin:";
 }
 
 
@@ -104,19 +104,19 @@ StorePath writeDerivation(Store & store,
 
 
 /* Read string `s' from stream `str'. */
-static void expect(std::istream & str, const string & s)
+static void expect(std::istream & str, std::string_view s)
 {
     char s2[s.size()];
     str.read(s2, s.size());
-    if (string(s2, s.size()) != s)
+    if (std::string(s2, s.size()) != s)
         throw FormatError("expected string '%1%'", s);
 }
 
 
 /* Read a C-style string from stream `str'. */
-static string parseString(std::istream & str)
+static std::string parseString(std::istream & str)
 {
-    string res;
+    std::string res;
     expect(str, "\"");
     int c;
     while ((c = str.get()) != '"')
@@ -172,7 +172,7 @@ static DerivationOutput parseDerivationOutput(const Store & store,
 {
     if (hashAlgo != "") {
         auto method = FileIngestionMethod::Flat;
-        if (string(hashAlgo, 0, 2) == "r:") {
+        if (hashAlgo.substr(0, 2) == "r:") {
             method = FileIngestionMethod::Recursive;
             hashAlgo = hashAlgo.substr(2);
         }
@@ -260,8 +260,8 @@ Derivation parseDerivation(const Store & store, std::string && s, std::string_vi
     /* Parse the environment variables. */
     expect(str, ",[");
     while (!endOfList(str)) {
-        expect(str, "("); string name = parseString(str);
-        expect(str, ","); string value = parseString(str);
+        expect(str, "("); auto name = parseString(str);
+        expect(str, ","); auto value = parseString(str);
         expect(str, ")");
         drv.env[name] = value;
     }
@@ -271,7 +271,7 @@ Derivation parseDerivation(const Store & store, std::string && s, std::string_vi
 }
 
 
-static void printString(string & res, std::string_view s)
+static void printString(std::string & res, std::string_view s)
 {
     boost::container::small_vector<char, 64 * 1024> buffer;
     buffer.reserve(s.size() * 2 + 2);
@@ -289,7 +289,7 @@ static void printString(string & res, std::string_view s)
 }
 
 
-static void printUnquotedString(string & res, std::string_view s)
+static void printUnquotedString(std::string & res, std::string_view s)
 {
     res += '"';
     res.append(s);
@@ -298,7 +298,7 @@ static void printUnquotedString(string & res, std::string_view s)
 
 
 template<class ForwardIterator>
-static void printStrings(string & res, ForwardIterator i, ForwardIterator j)
+static void printStrings(std::string & res, ForwardIterator i, ForwardIterator j)
 {
     res += '[';
     bool first = true;
@@ -311,7 +311,7 @@ static void printStrings(string & res, ForwardIterator i, ForwardIterator j)
 
 
 template<class ForwardIterator>
-static void printUnquotedStrings(string & res, ForwardIterator i, ForwardIterator j)
+static void printUnquotedStrings(std::string & res, ForwardIterator i, ForwardIterator j)
 {
     res += '[';
     bool first = true;
@@ -323,10 +323,10 @@ static void printUnquotedStrings(string & res, ForwardIterator i, ForwardIterato
 }
 
 
-string Derivation::unparse(const Store & store, bool maskOutputs,
+std::string Derivation::unparse(const Store & store, bool maskOutputs,
     std::map<std::string, StringSet> * actualInputs) const
 {
-    string s;
+    std::string s;
     s.reserve(65536);
     s += "Derive([";
 
@@ -401,7 +401,7 @@ string Derivation::unparse(const Store & store, bool maskOutputs,
 
 
 // FIXME: remove
-bool isDerivation(const string & fileName)
+bool isDerivation(const std::string & fileName)
 {
     return hasSuffix(fileName, drvExtension);
 }
@@ -593,7 +593,7 @@ std::map<std::string, Hash> staticOutputHashes(Store & store, const Derivation &
 }
 
 
-bool wantOutput(const string & output, const std::set<string> & wanted)
+bool wantOutput(const std::string & output, const std::set<std::string> & wanted)
 {
     return wanted.empty() || wanted.find(output) != wanted.end();
 }
diff --git a/src/libstore/derivations.hh b/src/libstore/derivations.hh
index a644cec60..132de82b6 100644
--- a/src/libstore/derivations.hh
+++ b/src/libstore/derivations.hh
@@ -59,21 +59,19 @@ struct DerivationOutput
     std::optional<StorePath> path(const Store & store, std::string_view drvName, std::string_view outputName) const;
 };
 
-typedef std::map<string, DerivationOutput> DerivationOutputs;
+typedef std::map<std::string, DerivationOutput> DerivationOutputs;
 
 /* These are analogues to the previous DerivationOutputs data type, but they
    also contains, for each output, the (optional) store path in which it would
    be written. To calculate values of these types, see the corresponding
    functions in BasicDerivation */
-typedef std::map<string, std::pair<DerivationOutput, std::optional<StorePath>>>
+typedef std::map<std::string, std::pair<DerivationOutput, std::optional<StorePath>>>
   DerivationOutputsAndOptPaths;
 
 /* For inputs that are sub-derivations, we specify exactly which
    output IDs we are interested in. */
 typedef std::map<StorePath, StringSet> DerivationInputs;
 
-typedef std::map<string, string> StringPairs;
-
 enum struct DerivationType : uint8_t {
     InputAddressed,
     DeferredInputAddressed,
@@ -103,7 +101,7 @@ struct BasicDerivation
 {
     DerivationOutputs outputs; /* keyed on symbolic IDs */
     StorePathSet inputSrcs; /* inputs that are sources */
-    string platform;
+    std::string platform;
     Path builder;
     Strings args;
     StringPairs env;
@@ -164,7 +162,7 @@ StorePath writeDerivation(Store & store,
 Derivation parseDerivation(const Store & store, std::string && s, std::string_view name);
 
 // FIXME: remove
-bool isDerivation(const string & fileName);
+bool isDerivation(const std::string & fileName);
 
 /* Calculate the name that will be used for the store path for this
    output.
@@ -222,7 +220,7 @@ typedef std::map<StorePath, DrvHashModulo> DrvHashes;
 // FIXME: global, though at least thread-safe.
 extern Sync<DrvHashes> drvHashes;
 
-bool wantOutput(const string & output, const std::set<string> & wanted);
+bool wantOutput(const std::string & output, const std::set<std::string> & wanted);
 
 struct Source;
 struct Sink;
diff --git a/src/libstore/derived-path.cc b/src/libstore/derived-path.cc
index 3d188e981..194489580 100644
--- a/src/libstore/derived-path.cc
+++ b/src/libstore/derived-path.cc
@@ -75,9 +75,9 @@ DerivedPath::Built DerivedPath::Built::parse(const Store & store, std::string_vi
     assert(n != s.npos);
     auto drvPath = store.parseStorePath(s.substr(0, n));
     auto outputsS = s.substr(n + 1);
-    std::set<string> outputs;
+    std::set<std::string> outputs;
     if (outputsS != "*")
-        outputs = tokenizeString<std::set<string>>(outputsS, ",");
+        outputs = tokenizeString<std::set<std::string>>(outputsS, ",");
     return {drvPath, outputs};
 }
 
diff --git a/src/libstore/dummy-store.cc b/src/libstore/dummy-store.cc
index 62dc21c59..b4fbe0b70 100644
--- a/src/libstore/dummy-store.cc
+++ b/src/libstore/dummy-store.cc
@@ -21,7 +21,7 @@ struct DummyStore : public virtual DummyStoreConfig, public virtual Store
         , Store(params)
     { }
 
-    string getUri() override
+    std::string getUri() override
     {
         return *uriSchemes().begin();
     }
@@ -43,8 +43,11 @@ struct DummyStore : public virtual DummyStoreConfig, public virtual Store
         RepairFlag repair, CheckSigsFlag checkSigs) override
     { unsupported("addToStore"); }
 
-    StorePath addTextToStore(const string & name, const string & s,
-        const StorePathSet & references, RepairFlag repair) override
+    StorePath addTextToStore(
+        std::string_view name,
+        std::string_view s,
+        const StorePathSet & references,
+        RepairFlag repair) override
     { unsupported("addTextToStore"); }
 
     void narFromPath(const StorePath & path, Sink & sink) override
diff --git a/src/libstore/filetransfer.cc b/src/libstore/filetransfer.cc
index 76fed11db..255b42c49 100644
--- a/src/libstore/filetransfer.cc
+++ b/src/libstore/filetransfer.cc
@@ -33,12 +33,12 @@ FileTransferSettings fileTransferSettings;
 
 static GlobalConfig::Register rFileTransferSettings(&fileTransferSettings);
 
-std::string resolveUri(const std::string & uri)
+std::string resolveUri(std::string_view uri)
 {
     if (uri.compare(0, 8, "channel:") == 0)
-        return "https://nixos.org/channels/" + std::string(uri, 8) + "/nixexprs.tar.xz";
+        return "https://nixos.org/channels/" + std::string(uri.substr(8)) + "/nixexprs.tar.xz";
     else
-        return uri;
+        return std::string(uri);
 }
 
 struct curlFileTransfer : public FileTransfer
@@ -197,15 +197,15 @@ struct curlFileTransfer : public FileTransfer
                 result.etag = "";
                 result.data.clear();
                 result.bodySize = 0;
-                statusMsg = trim(match[1]);
+                statusMsg = trim((std::string &) match[1]);
                 acceptRanges = false;
                 encoding = "";
             } else {
                 auto i = line.find(':');
-                if (i != string::npos) {
-                    string name = toLower(trim(string(line, 0, i)));
+                if (i != std::string::npos) {
+                    std::string name = toLower(trim(line.substr(0, i)));
                     if (name == "etag") {
-                        result.etag = trim(string(line, i + 1));
+                        result.etag = trim(line.substr(i + 1));
                         /* Hack to work around a GitHub bug: it sends
                            ETags, but ignores If-None-Match. So if we get
                            the expected ETag on a 200 response, then shut
@@ -218,8 +218,8 @@ struct curlFileTransfer : public FileTransfer
                             return 0;
                         }
                     } else if (name == "content-encoding")
-                        encoding = trim(string(line, i + 1));
-                    else if (name == "accept-ranges" && toLower(trim(std::string(line, i + 1))) == "bytes")
+                        encoding = trim(line.substr(i + 1));
+                    else if (name == "accept-ranges" && toLower(trim(line.substr(i + 1))) == "bytes")
                         acceptRanges = true;
                 }
             }
@@ -866,18 +866,18 @@ FileTransferError::FileTransferError(FileTransfer::Error error, std::optional<st
     // FIXME: Due to https://github.com/NixOS/nix/issues/3841 we don't know how
     // to print different messages for different verbosity levels. For now
     // we add some heuristics for detecting when we want to show the response.
-    if (response && (response->size() < 1024 || response->find("<html>") != string::npos))
+    if (response && (response->size() < 1024 || response->find("<html>") != std::string::npos))
         err.msg = hintfmt("%1%\n\nresponse body:\n\n%2%", normaltxt(hf.str()), chomp(*response));
     else
         err.msg = hf;
 }
 
-bool isUri(const string & s)
+bool isUri(std::string_view s)
 {
     if (s.compare(0, 8, "channel:") == 0) return true;
     size_t pos = s.find("://");
-    if (pos == string::npos) return false;
-    string scheme(s, 0, pos);
+    if (pos == std::string::npos) return false;
+    std::string scheme(s, 0, pos);
     return scheme == "http" || scheme == "https" || scheme == "file" || scheme == "channel" || scheme == "git" || scheme == "s3" || scheme == "ssh";
 }
 
diff --git a/src/libstore/filetransfer.hh b/src/libstore/filetransfer.hh
index 3e61b23b1..ca61e3937 100644
--- a/src/libstore/filetransfer.hh
+++ b/src/libstore/filetransfer.hh
@@ -119,17 +119,17 @@ class FileTransferError : public Error
 {
 public:
     FileTransfer::Error error;
-    std::optional<string> response; // intentionally optional
+    std::optional<std::string> response; // intentionally optional
 
     template<typename... Args>
-    FileTransferError(FileTransfer::Error error, std::optional<string> response, const Args & ... args);
+    FileTransferError(FileTransfer::Error error, std::optional<std::string> response, const Args & ... args);
 
     virtual const char* sname() const override { return "FileTransferError"; }
 };
 
-bool isUri(const string & s);
+bool isUri(std::string_view s);
 
 /* Resolve deprecated 'channel:<foo>' URLs. */
-std::string resolveUri(const std::string & uri);
+std::string resolveUri(std::string_view uri);
 
 }
diff --git a/src/libstore/gc.cc b/src/libstore/gc.cc
index e35199b3d..fd38b731c 100644
--- a/src/libstore/gc.cc
+++ b/src/libstore/gc.cc
@@ -47,9 +47,8 @@ static void makeSymlink(const Path & link, const Path & target)
 
 void LocalStore::addIndirectRoot(const Path & path)
 {
-    string hash = hashString(htSHA1, path).to_string(Base32, false);
-    Path realRoot = canonPath((format("%1%/%2%/auto/%3%")
-        % stateDir % gcRootsDir % hash).str());
+    std::string hash = hashString(htSHA1, path).to_string(Base32, false);
+    Path realRoot = canonPath(fmt("%1%/%2%/auto/%3%", stateDir, gcRootsDir, hash));
     makeSymlink(realRoot, path);
 }
 
@@ -162,7 +161,7 @@ void LocalStore::addTempRoot(const StorePath & path)
     }
 
     /* Append the store path to the temporary roots file. */
-    string s = printStorePath(path) + '\0';
+    auto s = printStorePath(path) + '\0';
     writeFull(state->fdTempRoots.get(), s);
 }
 
@@ -203,12 +202,12 @@ void LocalStore::findTempRoots(Roots & tempRoots, bool censor)
         }
 
         /* Read the entire file. */
-        string contents = readFile(fd.get());
+        auto contents = readFile(fd.get());
 
         /* Extract the roots. */
-        string::size_type pos = 0, end;
+        std::string::size_type pos = 0, end;
 
-        while ((end = contents.find((char) 0, pos)) != string::npos) {
+        while ((end = contents.find((char) 0, pos)) != std::string::npos) {
             Path root(contents, pos, end - pos);
             debug("got temporary root '%s'", root);
             tempRoots[parseStorePath(root)].emplace(censor ? censored : fmt("{temp:%d}", pid));
@@ -305,7 +304,7 @@ Roots LocalStore::findRoots(bool censor)
 
 typedef std::unordered_map<Path, std::unordered_set<std::string>> UncheckedRoots;
 
-static void readProcLink(const string & file, UncheckedRoots & roots)
+static void readProcLink(const std::string & file, UncheckedRoots & roots)
 {
     /* 64 is the starting buffer size gnu readlink uses... */
     auto bufsiz = ssize_t{64};
@@ -328,7 +327,7 @@ try_again:
             .emplace(file);
 }
 
-static string quoteRegexChars(const string & raw)
+static std::string quoteRegexChars(const std::string & raw)
 {
     static auto specialRegex = std::regex(R"([.^$\\*+?()\[\]{}|])");
     return std::regex_replace(raw, specialRegex, R"(\$&)");
@@ -383,7 +382,7 @@ void LocalStore::findRuntimeRoots(Roots & roots, bool censor)
 
                 try {
                     auto mapFile = fmt("/proc/%s/maps", ent->d_name);
-                    auto mapLines = tokenizeString<std::vector<string>>(readFile(mapFile), "\n");
+                    auto mapLines = tokenizeString<std::vector<std::string>>(readFile(mapFile), "\n");
                     for (const auto & line : mapLines) {
                         auto match = std::smatch{};
                         if (std::regex_match(line, match, mapRegex))
@@ -784,7 +783,7 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
             struct dirent * dirent;
             while (errno = 0, dirent = readdir(dir.get())) {
                 checkInterrupt();
-                string name = dirent->d_name;
+                std::string name = dirent->d_name;
                 if (name == "." || name == ".." || name == linksName) continue;
 
                 if (auto storePath = maybeParseStorePath(storeDir + "/" + name))
@@ -825,7 +824,7 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
         struct dirent * dirent;
         while (errno = 0, dirent = readdir(dir.get())) {
             checkInterrupt();
-            string name = dirent->d_name;
+            std::string name = dirent->d_name;
             if (name == "." || name == "..") continue;
             Path path = linksDir + "/" + name;
 
diff --git a/src/libstore/globals.cc b/src/libstore/globals.cc
index 81ca9cc0f..cc009a026 100644
--- a/src/libstore/globals.cc
+++ b/src/libstore/globals.cc
@@ -100,7 +100,7 @@ std::vector<Path> getUserConfigFiles()
     // Use the paths specified in NIX_USER_CONF_FILES if it has been defined
     auto nixConfFiles = getEnv("NIX_USER_CONF_FILES");
     if (nixConfFiles.has_value()) {
-        return tokenizeString<std::vector<string>>(nixConfFiles.value(), ":");
+        return tokenizeString<std::vector<std::string>>(nixConfFiles.value(), ":");
     }
 
     // Use the paths specified by the XDG spec
@@ -181,7 +181,7 @@ bool Settings::isWSL1()
     return hasSuffix(utsbuf.release, "-Microsoft");
 }
 
-const string nixVersion = PACKAGE_VERSION;
+const std::string nixVersion = PACKAGE_VERSION;
 
 NLOHMANN_JSON_SERIALIZE_ENUM(SandboxMode, {
     {SandboxMode::smEnabled, true},
diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index 4a78729e9..b31a2e8dc 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -988,6 +988,6 @@ void loadConfFile();
 // Used by the Settings constructor
 std::vector<Path> getUserConfigFiles();
 
-extern const string nixVersion;
+extern const std::string nixVersion;
 
 }
diff --git a/src/libstore/legacy-ssh-store.cc b/src/libstore/legacy-ssh-store.cc
index f8b2662af..6b3daae7f 100644
--- a/src/libstore/legacy-ssh-store.cc
+++ b/src/libstore/legacy-ssh-store.cc
@@ -48,7 +48,7 @@ struct LegacySSHStore : public virtual LegacySSHStoreConfig, public virtual Stor
 
     static std::set<std::string> uriSchemes() { return {"ssh"}; }
 
-    LegacySSHStore(const string & scheme, const string & host, const Params & params)
+    LegacySSHStore(const std::string & scheme, const std::string & host, const Params & params)
         : StoreConfig(params)
         , LegacySSHStoreConfig(params)
         , Store(params)
@@ -107,7 +107,7 @@ struct LegacySSHStore : public virtual LegacySSHStoreConfig, public virtual Stor
         return conn;
     };
 
-    string getUri() override
+    std::string getUri() override
     {
         return *uriSchemes().begin() + "://" + host;
     }
@@ -225,13 +225,21 @@ struct LegacySSHStore : public virtual LegacySSHStoreConfig, public virtual Stor
     std::optional<StorePath> queryPathFromHashPart(const std::string & hashPart) override
     { unsupported("queryPathFromHashPart"); }
 
-    StorePath addToStore(const string & name, const Path & srcPath,
-        FileIngestionMethod method, HashType hashAlgo,
-        PathFilter & filter, RepairFlag repair, const StorePathSet & references) override
+    StorePath addToStore(
+        std::string_view name,
+        const Path & srcPath,
+        FileIngestionMethod method,
+        HashType hashAlgo,
+        PathFilter & filter,
+        RepairFlag repair,
+        const StorePathSet & references) override
     { unsupported("addToStore"); }
 
-    StorePath addTextToStore(const string & name, const string & s,
-        const StorePathSet & references, RepairFlag repair) override
+    StorePath addTextToStore(
+        std::string_view name,
+        std::string_view s,
+        const StorePathSet & references,
+        RepairFlag repair) override
     { unsupported("addTextToStore"); }
 
 private:
diff --git a/src/libstore/local-fs-store.cc b/src/libstore/local-fs-store.cc
index c933251db..c5ae7536f 100644
--- a/src/libstore/local-fs-store.cc
+++ b/src/libstore/local-fs-store.cc
@@ -85,7 +85,7 @@ void LocalFSStore::narFromPath(const StorePath & path, Sink & sink)
     dumpPath(getRealStoreDir() + std::string(printStorePath(path), storeDir.size()), sink);
 }
 
-const string LocalFSStore::drvsLogDir = "drvs";
+const std::string LocalFSStore::drvsLogDir = "drvs";
 
 std::optional<std::string> LocalFSStore::getBuildLog(const StorePath & path_)
 {
diff --git a/src/libstore/local-fs-store.hh b/src/libstore/local-fs-store.hh
index e44b27cc2..d34f0cb62 100644
--- a/src/libstore/local-fs-store.hh
+++ b/src/libstore/local-fs-store.hh
@@ -27,7 +27,7 @@ class LocalFSStore : public virtual LocalFSStoreConfig, public virtual Store
 {
 public:
 
-    const static string drvsLogDir;
+    const static std::string drvsLogDir;
 
     LocalFSStore(const Params & params);
 
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index 1a02b916a..1ee71b1c0 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -70,7 +70,7 @@ int getSchema(Path schemaPath)
 {
     int curSchema = 0;
     if (pathExists(schemaPath)) {
-        string s = readFile(schemaPath);
+        auto s = readFile(schemaPath);
         auto n = string2Int<int>(s);
         if (!n)
             throw Error("'%1%' is corrupt", schemaPath);
@@ -239,7 +239,7 @@ LocalStore::LocalStore(const Params & params)
             res = posix_fallocate(fd.get(), 0, settings.reservedSize);
 #endif
             if (res == -1) {
-                writeFull(fd.get(), string(settings.reservedSize, 'X'));
+                writeFull(fd.get(), std::string(settings.reservedSize, 'X'));
                 [[gnu::unused]] auto res2 = ftruncate(fd.get(), settings.reservedSize);
             }
         }
@@ -450,7 +450,7 @@ void LocalStore::openDB(State & state, bool create)
         throw SysError("Nix database directory '%1%' is not writable", dbDir);
 
     /* Open the Nix database. */
-    string dbPath = dbDir + "/db.sqlite";
+    std::string dbPath = dbDir + "/db.sqlite";
     auto & db(state.db);
     state.db = SQLite(dbPath, create);
 
@@ -471,19 +471,19 @@ void LocalStore::openDB(State & state, bool create)
        should be safe enough.  If the user asks for it, don't sync at
        all.  This can cause database corruption if the system
        crashes. */
-    string syncMode = settings.fsyncMetadata ? "normal" : "off";
+    std::string syncMode = settings.fsyncMetadata ? "normal" : "off";
     db.exec("pragma synchronous = " + syncMode);
 
     /* Set the SQLite journal mode.  WAL mode is fastest, so it's the
        default. */
-    string mode = settings.useSQLiteWAL ? "wal" : "truncate";
-    string prevMode;
+    std::string mode = settings.useSQLiteWAL ? "wal" : "truncate";
+    std::string prevMode;
     {
         SQLiteStmt stmt;
         stmt.create(db, "pragma main.journal_mode;");
         if (sqlite3_step(stmt) != SQLITE_ROW)
             throwSQLiteError(db, "querying journal mode");
-        prevMode = string((const char *) sqlite3_column_text(stmt, 0));
+        prevMode = std::string((const char *) sqlite3_column_text(stmt, 0));
     }
     if (prevMode != mode &&
         sqlite3_exec(db, ("pragma main.journal_mode = " + mode + ";").c_str(), 0, 0, 0) != SQLITE_OK)
@@ -679,7 +679,7 @@ void LocalStore::checkDerivationOutputs(const StorePath & drvPath, const Derivat
 {
     assert(drvPath.isDerivation());
     std::string drvName(drvPath.name());
-    drvName = string(drvName, 0, drvName.size() - drvExtension.size());
+    drvName = drvName.substr(0, drvName.size() - drvExtension.size());
 
     auto envHasRightPath = [&](const StorePath & actual, const std::string & varName)
     {
@@ -786,7 +786,11 @@ void LocalStore::registerDrvOutput(const Realisation & info)
     });
 }
 
-void LocalStore::cacheDrvOutputMapping(State & state, const uint64_t deriver, const string & outputName, const StorePath & output)
+void LocalStore::cacheDrvOutputMapping(
+    State & state,
+    const uint64_t deriver,
+    const std::string & outputName,
+    const StorePath & output)
 {
     retrySQLite<void>([&]() {
         state.stmts->AddDerivationOutput.use()
@@ -795,7 +799,6 @@ void LocalStore::cacheDrvOutputMapping(State & state, const uint64_t deriver, co
             (printStorePath(output))
             .exec();
     });
-
 }
 
 
@@ -1436,7 +1439,9 @@ StorePath LocalStore::addToStoreFromDump(Source & source0, std::string_view name
 }
 
 
-StorePath LocalStore::addTextToStore(const string & name, const string & s,
+StorePath LocalStore::addTextToStore(
+    std::string_view name,
+    std::string_view s,
     const StorePathSet & references, RepairFlag repair)
 {
     auto hash = hashString(htSHA256, s);
@@ -1548,7 +1553,7 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
         for (auto & link : readDirectory(linksDir)) {
             printMsg(lvlTalkative, "checking contents of '%s'", link.name);
             Path linkPath = linksDir + "/" + link.name;
-            string hash = hashPath(htSHA256, linkPath).first.to_string(Base32, false);
+            std::string hash = hashPath(htSHA256, linkPath).first.to_string(Base32, false);
             if (hash != link.name) {
                 printError("link '%s' was modified! expected hash '%s', got '%s'",
                     linkPath, link.name, hash);
diff --git a/src/libstore/local-store.hh b/src/libstore/local-store.hh
index a9c7475ac..1a278c9a8 100644
--- a/src/libstore/local-store.hh
+++ b/src/libstore/local-store.hh
@@ -147,8 +147,11 @@ public:
     StorePath addToStoreFromDump(Source & dump, std::string_view name,
         FileIngestionMethod method, HashType hashAlgo, RepairFlag repair, const StorePathSet & references) override;
 
-    StorePath addTextToStore(const string & name, const string & s,
-        const StorePathSet & references, RepairFlag repair) override;
+    StorePath addTextToStore(
+        std::string_view name,
+        std::string_view s,
+        const StorePathSet & references,
+        RepairFlag repair) override;
 
     void addTempRoot(const StorePath & path) override;
 
@@ -204,7 +207,11 @@ public:
        derivation 'deriver'. */
     void registerDrvOutput(const Realisation & info) override;
     void registerDrvOutput(const Realisation & info, CheckSigsFlag checkSigs) override;
-    void cacheDrvOutputMapping(State & state, const uint64_t deriver, const string & outputName, const StorePath & output);
+    void cacheDrvOutputMapping(
+        State & state,
+        const uint64_t deriver,
+        const std::string & outputName,
+        const StorePath & output);
 
     std::optional<const Realisation> queryRealisation_(State & state, const DrvOutput & id);
     std::optional<std::pair<int64_t, Realisation>> queryRealisationCore_(State & state, const DrvOutput & id);
diff --git a/src/libstore/lock.hh b/src/libstore/lock.hh
index 8fbb67ddc..3d29a7b5b 100644
--- a/src/libstore/lock.hh
+++ b/src/libstore/lock.hh
@@ -13,7 +13,7 @@ private:
     AutoCloseFD fdUserLock;
 
     bool isEnabled = false;
-    string user;
+    std::string user;
     uid_t uid = 0;
     gid_t gid = 0;
     std::vector<gid_t> supplementaryGIDs;
@@ -23,7 +23,7 @@ public:
 
     void kill();
 
-    string getUser() { return user; }
+    std::string getUser() { return user; }
     uid_t getUID() { assert(uid); return uid; }
     uid_t getGID() { assert(gid); return gid; }
     std::vector<gid_t> getSupplementaryGIDs() { return supplementaryGIDs; }
diff --git a/src/libstore/machines.cc b/src/libstore/machines.cc
index b6270a81b..e87f46980 100644
--- a/src/libstore/machines.cc
+++ b/src/libstore/machines.cc
@@ -39,19 +39,19 @@ Machine::Machine(decltype(storeUri) storeUri,
     sshPublicHostKey(sshPublicHostKey)
 {}
 
-bool Machine::allSupported(const std::set<string> & features) const
+bool Machine::allSupported(const std::set<std::string> & features) const
 {
     return std::all_of(features.begin(), features.end(),
-        [&](const string & feature) {
+        [&](const std::string & feature) {
             return supportedFeatures.count(feature) ||
                 mandatoryFeatures.count(feature);
         });
 }
 
-bool Machine::mandatoryMet(const std::set<string> & features) const
+bool Machine::mandatoryMet(const std::set<std::string> & features) const
 {
     return std::all_of(mandatoryFeatures.begin(), mandatoryFeatures.end(),
-        [&](const string & feature) {
+        [&](const std::string & feature) {
             return features.count(feature);
         });
 }
@@ -89,7 +89,7 @@ ref<Store> Machine::openStore() const
 static std::vector<std::string> expandBuilderLines(const std::string & builders)
 {
     std::vector<std::string> result;
-    for (auto line : tokenizeString<std::vector<string>>(builders, "\n;")) {
+    for (auto line : tokenizeString<std::vector<std::string>>(builders, "\n;")) {
         trim(line);
         line.erase(std::find(line.begin(), line.end(), '#'), line.end());
         if (line.empty()) continue;
@@ -117,7 +117,7 @@ static std::vector<std::string> expandBuilderLines(const std::string & builders)
 
 static Machine parseBuilderLine(const std::string & line)
 {
-    const auto tokens = tokenizeString<std::vector<string>>(line);
+    const auto tokens = tokenizeString<std::vector<std::string>>(line);
 
     auto isSet = [&](size_t fieldIndex) {
         return tokens.size() > fieldIndex && tokens[fieldIndex] != "" && tokens[fieldIndex] != "-";
@@ -146,17 +146,18 @@ static Machine parseBuilderLine(const std::string & line)
 
     return {
         tokens[0],
-        isSet(1) ? tokenizeString<std::vector<string>>(tokens[1], ",") : std::vector<string>{settings.thisSystem},
+        isSet(1) ? tokenizeString<std::vector<std::string>>(tokens[1], ",") : std::vector<std::string>{settings.thisSystem},
         isSet(2) ? tokens[2] : "",
         isSet(3) ? parseUnsignedIntField(3) : 1U,
         isSet(4) ? parseUnsignedIntField(4) : 1U,
-        isSet(5) ? tokenizeString<std::set<string>>(tokens[5], ",") : std::set<string>{},
-        isSet(6) ? tokenizeString<std::set<string>>(tokens[6], ",") : std::set<string>{},
+        isSet(5) ? tokenizeString<std::set<std::string>>(tokens[5], ",") : std::set<std::string>{},
+        isSet(6) ? tokenizeString<std::set<std::string>>(tokens[6], ",") : std::set<std::string>{},
         isSet(7) ? ensureBase64(7) : ""
     };
 }
 
-static Machines parseBuilderLines(const std::vector<std::string>& builders) {
+static Machines parseBuilderLines(const std::vector<std::string> & builders)
+{
     Machines result;
     std::transform(builders.begin(), builders.end(), std::back_inserter(result), parseBuilderLine);
     return result;
diff --git a/src/libstore/nar-accessor.cc b/src/libstore/nar-accessor.cc
index 7d27d7667..72d41cc94 100644
--- a/src/libstore/nar-accessor.cc
+++ b/src/libstore/nar-accessor.cc
@@ -90,7 +90,7 @@ struct NarAccessor : public FSAccessor
         void receiveContents(std::string_view data) override
         { }
 
-        void createSymlink(const Path & path, const string & target) override
+        void createSymlink(const Path & path, const std::string & target) override
         {
             createMember(path,
                 NarMember{FSAccessor::Type::tSymlink, false, 0, 0, target});
diff --git a/src/libstore/nar-info.cc b/src/libstore/nar-info.cc
index 49079388a..2d75e7a82 100644
--- a/src/libstore/nar-info.cc
+++ b/src/libstore/nar-info.cc
@@ -11,7 +11,7 @@ NarInfo::NarInfo(const Store & store, const std::string & s, const std::string &
         return Error("NAR info file '%1%' is corrupt", whence);
     };
 
-    auto parseHashField = [&](const string & s) {
+    auto parseHashField = [&](const std::string & s) {
         try {
             return Hash::parseAnyPrefixed(s);
         } catch (BadHash &) {
diff --git a/src/libstore/optimise-store.cc b/src/libstore/optimise-store.cc
index 13cb142f8..8af9b1dde 100644
--- a/src/libstore/optimise-store.cc
+++ b/src/libstore/optimise-store.cc
@@ -77,7 +77,7 @@ Strings LocalStore::readDirectoryIgnoringInodes(const Path & path, const InodeHa
             continue;
         }
 
-        string name = dirent->d_name;
+        std::string name = dirent->d_name;
         if (name == "." || name == "..") continue;
         names.push_back(name);
     }
diff --git a/src/libstore/path-with-outputs.cc b/src/libstore/path-with-outputs.cc
index e5a121e00..97aa01b57 100644
--- a/src/libstore/path-with-outputs.cc
+++ b/src/libstore/path-with-outputs.cc
@@ -49,9 +49,9 @@ std::pair<std::string_view, StringSet> parsePathWithOutputs(std::string_view s)
 {
     size_t n = s.find("!");
     return n == s.npos
-        ? std::make_pair(s, std::set<string>())
+        ? std::make_pair(s, std::set<std::string>())
         : std::make_pair(((std::string_view) s).substr(0, n),
-            tokenizeString<std::set<string>>(((std::string_view) s).substr(n + 1), ","));
+            tokenizeString<std::set<std::string>>(((std::string_view) s).substr(n + 1), ","));
 }
 
 
diff --git a/src/libstore/path.hh b/src/libstore/path.hh
index 06ba0663b..e65fee622 100644
--- a/src/libstore/path.hh
+++ b/src/libstore/path.hh
@@ -62,7 +62,7 @@ public:
 
 typedef std::set<StorePath> StorePathSet;
 typedef std::vector<StorePath> StorePaths;
-typedef std::map<string, StorePath> OutputPathMap;
+typedef std::map<std::string, StorePath> OutputPathMap;
 
 typedef std::map<StorePath, std::optional<ContentAddress>> StorePathCAMap;
 
diff --git a/src/libstore/pathlocks.cc b/src/libstore/pathlocks.cc
index 2da74e262..42023cd0a 100644
--- a/src/libstore/pathlocks.cc
+++ b/src/libstore/pathlocks.cc
@@ -74,7 +74,7 @@ PathLocks::PathLocks()
 }
 
 
-PathLocks::PathLocks(const PathSet & paths, const string & waitMsg)
+PathLocks::PathLocks(const PathSet & paths, const std::string & waitMsg)
     : deletePaths(false)
 {
     lockPaths(paths, waitMsg);
@@ -82,7 +82,7 @@ PathLocks::PathLocks(const PathSet & paths, const string & waitMsg)
 
 
 bool PathLocks::lockPaths(const PathSet & paths,
-    const string & waitMsg, bool wait)
+    const std::string & waitMsg, bool wait)
 {
     assert(fds.empty());
 
diff --git a/src/libstore/pathlocks.hh b/src/libstore/pathlocks.hh
index 759b9a584..5e3a734b4 100644
--- a/src/libstore/pathlocks.hh
+++ b/src/libstore/pathlocks.hh
@@ -26,9 +26,9 @@ private:
 public:
     PathLocks();
     PathLocks(const PathSet & paths,
-        const string & waitMsg = "");
+        const std::string & waitMsg = "");
     bool lockPaths(const PathSet & _paths,
-        const string & waitMsg = "",
+        const std::string & waitMsg = "",
         bool wait = true);
     ~PathLocks();
     void unlock();
diff --git a/src/libstore/profiles.cc b/src/libstore/profiles.cc
index 73163424c..3e4188188 100644
--- a/src/libstore/profiles.cc
+++ b/src/libstore/profiles.cc
@@ -15,12 +15,12 @@ namespace nix {
 
 /* Parse a generation name of the format
    `<profilename>-<number>-link'. */
-static std::optional<GenerationNumber> parseName(const string & profileName, const string & name)
+static std::optional<GenerationNumber> parseName(const std::string & profileName, const std::string & name)
 {
-    if (string(name, 0, profileName.size() + 1) != profileName + "-") return {};
-    string s = string(name, profileName.size() + 1);
-    string::size_type p = s.find("-link");
-    if (p == string::npos) return {};
+    if (name.substr(0, profileName.size() + 1) != profileName + "-") return {};
+    auto s = name.substr(profileName.size() + 1);
+    auto p = s.find("-link");
+    if (p == std::string::npos) return {};
     if (auto n = string2Int<unsigned int>(s.substr(0, p)))
         return *n;
     else
@@ -209,13 +209,13 @@ void deleteGenerationsOlderThan(const Path & profile, time_t t, bool dryRun)
 }
 
 
-void deleteGenerationsOlderThan(const Path & profile, const string & timeSpec, bool dryRun)
+void deleteGenerationsOlderThan(const Path & profile, std::string_view timeSpec, bool dryRun)
 {
     if (timeSpec.empty() || timeSpec[timeSpec.size() - 1] != 'd')
         throw UsageError("invalid number of days specifier '%1%', expected something like '14d'", timeSpec);
 
     time_t curTime = time(0);
-    string strDays = string(timeSpec, 0, timeSpec.size() - 1);
+    auto strDays = timeSpec.substr(0, timeSpec.size() - 1);
     auto days = string2Int<int>(strDays);
 
     if (!days || *days < 1)
@@ -274,7 +274,7 @@ void lockProfile(PathLocks & lock, const Path & profile)
 }
 
 
-string optimisticLockProfile(const Path & profile)
+std::string optimisticLockProfile(const Path & profile)
 {
     return pathExists(profile) ? readLink(profile) : "";
 }
diff --git a/src/libstore/profiles.hh b/src/libstore/profiles.hh
index d100c970c..408ca039c 100644
--- a/src/libstore/profiles.hh
+++ b/src/libstore/profiles.hh
@@ -42,7 +42,7 @@ void deleteOldGenerations(const Path & profile, bool dryRun);
 
 void deleteGenerationsOlderThan(const Path & profile, time_t t, bool dryRun);
 
-void deleteGenerationsOlderThan(const Path & profile, const string & timeSpec, bool dryRun);
+void deleteGenerationsOlderThan(const Path & profile, std::string_view timeSpec, bool dryRun);
 
 void switchLink(Path link, Path target);
 
@@ -66,7 +66,7 @@ void lockProfile(PathLocks & lock, const Path & profile);
    generally cheap, since the build results are still in the Nix
    store.  Most of the time, only the user environment has to be
    rebuilt. */
-string optimisticLockProfile(const Path & profile);
+std::string optimisticLockProfile(const Path & profile);
 
 /* Resolve ~/.nix-profile. If ~/.nix-profile doesn't exist yet, create
    it. */
diff --git a/src/libstore/references.cc b/src/libstore/references.cc
index 91b3fc142..34dce092c 100644
--- a/src/libstore/references.cc
+++ b/src/libstore/references.cc
@@ -68,7 +68,7 @@ void RefScanSink::operator () (std::string_view data)
 
 
 std::pair<StorePathSet, HashResult> scanForReferences(
-    const string & path,
+    const std::string & path,
     const StorePathSet & refs)
 {
     HashSink hashSink { htSHA256 };
@@ -121,7 +121,7 @@ void RewritingSink::operator () (std::string_view data)
     s.append(data);
 
     size_t j = 0;
-    while ((j = s.find(from, j)) != string::npos) {
+    while ((j = s.find(from, j)) != std::string::npos) {
         matches.push_back(pos + j);
         s.replace(j, from.size(), to);
     }
diff --git a/src/libstore/remote-store.cc b/src/libstore/remote-store.cc
index c6f083dea..e7ffa6595 100644
--- a/src/libstore/remote-store.cc
+++ b/src/libstore/remote-store.cc
@@ -661,8 +661,11 @@ void RemoteStore::addMultipleToStore(
 }
 
 
-StorePath RemoteStore::addTextToStore(const string & name, const string & s,
-    const StorePathSet & references, RepairFlag repair)
+StorePath RemoteStore::addTextToStore(
+    std::string_view name,
+    std::string_view s,
+    const StorePathSet & references,
+    RepairFlag repair)
 {
     StringSource source(s);
     return addCAToStore(source, name, TextHashMethod{}, references, repair)->path;
@@ -1000,7 +1003,7 @@ std::exception_ptr RemoteStore::Connection::processStderr(Sink * sink, Source *
         auto msg = readNum<uint64_t>(from);
 
         if (msg == STDERR_WRITE) {
-            string s = readString(from);
+            auto s = readString(from);
             if (!sink) throw Error("no sink");
             (*sink)(s);
         }
@@ -1017,7 +1020,7 @@ std::exception_ptr RemoteStore::Connection::processStderr(Sink * sink, Source *
             if (GET_PROTOCOL_MINOR(daemonVersion) >= 26) {
                 return std::make_exception_ptr(readError(from));
             } else {
-                string error = readString(from);
+                auto error = readString(from);
                 unsigned int status = readInt(from);
                 return std::make_exception_ptr(Error(status, error));
             }
diff --git a/src/libstore/remote-store.hh b/src/libstore/remote-store.hh
index 55cfd5cc6..b94216d31 100644
--- a/src/libstore/remote-store.hh
+++ b/src/libstore/remote-store.hh
@@ -83,8 +83,11 @@ public:
         RepairFlag repair,
         CheckSigsFlag checkSigs) override;
 
-    StorePath addTextToStore(const string & name, const string & s,
-        const StorePathSet & references, RepairFlag repair) override;
+    StorePath addTextToStore(
+        std::string_view name,
+        std::string_view s,
+        const StorePathSet & references,
+        RepairFlag repair) override;
 
     void registerDrvOutput(const Realisation & info) override;
 
diff --git a/src/libstore/s3-binary-cache-store.cc b/src/libstore/s3-binary-cache-store.cc
index a024e971d..844553ad3 100644
--- a/src/libstore/s3-binary-cache-store.cc
+++ b/src/libstore/s3-binary-cache-store.cc
@@ -87,7 +87,11 @@ static void initAWS()
     });
 }
 
-S3Helper::S3Helper(const string & profile, const string & region, const string & scheme, const string & endpoint)
+S3Helper::S3Helper(
+    const std::string & profile,
+    const std::string & region,
+    const std::string & scheme,
+    const std::string & endpoint)
     : config(makeConfig(region, scheme, endpoint))
     , client(make_ref<Aws::S3::S3Client>(
             profile == ""
@@ -121,7 +125,10 @@ class RetryStrategy : public Aws::Client::DefaultRetryStrategy
     }
 };
 
-ref<Aws::Client::ClientConfiguration> S3Helper::makeConfig(const string & region, const string & scheme, const string & endpoint)
+ref<Aws::Client::ClientConfiguration> S3Helper::makeConfig(
+    const std::string & region,
+    const std::string & scheme,
+    const std::string & endpoint)
 {
     initAWS();
     auto res = make_ref<Aws::Client::ClientConfiguration>();
diff --git a/src/libstore/sqlite.cc b/src/libstore/sqlite.cc
index 1d6baf02d..e6ecadd7f 100644
--- a/src/libstore/sqlite.cc
+++ b/src/libstore/sqlite.cc
@@ -71,7 +71,7 @@ uint64_t SQLite::getLastInsertedRowId()
     return sqlite3_last_insert_rowid(db);
 }
 
-void SQLiteStmt::create(sqlite3 * db, const string & sql)
+void SQLiteStmt::create(sqlite3 * db, const std::string & sql)
 {
     checkInterrupt();
     assert(!stmt);
diff --git a/src/libstore/ssh.cc b/src/libstore/ssh.cc
index 93f72675d..1bbad71f2 100644
--- a/src/libstore/ssh.cc
+++ b/src/libstore/ssh.cc
@@ -29,7 +29,7 @@ void SSHMaster::addCommonSSHOpts(Strings & args)
     if (!sshPublicHostKey.empty()) {
         Path fileName = (Path) *state->tmpDir + "/host-key";
         auto p = host.rfind("@");
-        string thost = p != string::npos ? string(host, p + 1) : host;
+        std::string thost = p != std::string::npos ? std::string(host, p + 1) : host;
         writeFile(fileName, thost + " " + base64Decode(sshPublicHostKey) + "\n");
         args.insert(args.end(), {"-oUserKnownHostsFile=" + fileName});
     }
diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index 8fcdc8b57..86fa6a211 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -39,7 +39,7 @@ Path Store::followLinksToStore(std::string_view _path) const
     Path path = absPath(std::string(_path));
     while (!isInStore(path)) {
         if (!isLink(path)) break;
-        string target = readLink(path);
+        auto target = readLink(path);
         path = absPath(target, dirOf(path));
     }
     if (!isInStore(path))
@@ -138,8 +138,8 @@ StorePath Store::makeStorePath(std::string_view type,
     std::string_view hash, std::string_view name) const
 {
     /* e.g., "source:sha256:1abc...:/nix/store:foo.tar.gz" */
-    string s = std::string { type } + ":" + std::string { hash }
-        + ":" + storeDir + ":" + std::string { name };
+    auto s = std::string(type) + ":" + std::string(hash)
+        + ":" + storeDir + ":" + std::string(name);
     auto h = compressHash(hashString(htSHA256, s), 20);
     return StorePath(h, name);
 }
@@ -161,7 +161,7 @@ StorePath Store::makeOutputPath(std::string_view id,
 
 static std::string makeType(
     const Store & store,
-    string && type,
+    std::string && type,
     const StorePathSet & references,
     bool hasSelfReference = false)
 {
@@ -229,15 +229,23 @@ std::pair<StorePath, Hash> Store::computeStorePathForPath(std::string_view name,
 }
 
 
-StorePath Store::computeStorePathForText(const string & name, const string & s,
+StorePath Store::computeStorePathForText(
+    std::string_view name,
+    std::string_view s,
     const StorePathSet & references) const
 {
     return makeTextPath(name, hashString(htSHA256, s), references);
 }
 
 
-StorePath Store::addToStore(const string & name, const Path & _srcPath,
-    FileIngestionMethod method, HashType hashAlgo, PathFilter & filter, RepairFlag repair, const StorePathSet & references)
+StorePath Store::addToStore(
+    std::string_view name,
+    const Path & _srcPath,
+    FileIngestionMethod method,
+    HashType hashAlgo,
+    PathFilter & filter,
+    RepairFlag repair,
+    const StorePathSet & references)
 {
     Path srcPath(absPath(_srcPath));
     auto source = sinkToSource([&](Sink & sink) {
@@ -688,10 +696,10 @@ StorePathSet Store::queryValidPaths(const StorePathSet & paths, SubstituteFlag m
 /* Return a string accepted by decodeValidPathInfo() that
    registers the specified paths as valid.  Note: it's the
    responsibility of the caller to provide a closure. */
-string Store::makeValidityRegistration(const StorePathSet & paths,
+std::string Store::makeValidityRegistration(const StorePathSet & paths,
     bool showDerivers, bool showHash)
 {
-    string s = "";
+    std::string s = "";
 
     for (auto & i : paths) {
         s += printStorePath(i) + "\n";
@@ -1131,7 +1139,7 @@ std::optional<ValidPathInfo> decodeValidPathInfo(const Store & store, std::istre
     getline(str, path);
     if (str.eof()) { return {}; }
     if (!hashGiven) {
-        string s;
+        std::string s;
         getline(str, s);
         auto narHash = Hash::parseAny(s, htSHA256);
         getline(str, s);
@@ -1144,7 +1152,7 @@ std::optional<ValidPathInfo> decodeValidPathInfo(const Store & store, std::istre
     std::string deriver;
     getline(str, deriver);
     if (deriver != "") info.deriver = store.parseStorePath(deriver);
-    string s;
+    std::string s;
     getline(str, s);
     auto n = string2Int<int>(s);
     if (!n) throw Error("number expected");
@@ -1168,7 +1176,7 @@ std::string Store::showPaths(const StorePathSet & paths)
 }
 
 
-string showPaths(const PathSet & paths)
+std::string showPaths(const PathSet & paths)
 {
     return concatStringsSep(", ", quoteStrings(paths));
 }
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index 90d2e93ed..e4fb1f1fd 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -352,7 +352,9 @@ public:
        simply yield a different store path, so other users wouldn't be
        affected), but it has some backwards compatibility issues (the
        hashing scheme changes), so I'm not doing that for now. */
-    StorePath computeStorePathForText(const string & name, const string & s,
+    StorePath computeStorePathForText(
+        std::string_view name,
+        std::string_view s,
         const StorePathSet & references) const;
 
     /* Check whether a path is valid. */
@@ -482,9 +484,14 @@ public:
        validity the resulting path.  The resulting path is returned.
        The function object `filter' can be used to exclude files (see
        libutil/archive.hh). */
-    virtual StorePath addToStore(const string & name, const Path & srcPath,
-        FileIngestionMethod method = FileIngestionMethod::Recursive, HashType hashAlgo = htSHA256,
-        PathFilter & filter = defaultPathFilter, RepairFlag repair = NoRepair, const StorePathSet & references = StorePathSet());
+    virtual StorePath addToStore(
+        std::string_view name,
+        const Path & srcPath,
+        FileIngestionMethod method = FileIngestionMethod::Recursive,
+        HashType hashAlgo = htSHA256,
+        PathFilter & filter = defaultPathFilter,
+        RepairFlag repair = NoRepair,
+        const StorePathSet & references = StorePathSet());
 
     /* Copy the contents of a path to the store and register the
        validity the resulting path, using a constant amount of
@@ -506,8 +513,11 @@ public:
 
     /* Like addToStore, but the contents written to the output path is
        a regular file containing the given string. */
-    virtual StorePath addTextToStore(const string & name, const string & s,
-        const StorePathSet & references, RepairFlag repair = NoRepair) = 0;
+    virtual StorePath addTextToStore(
+        std::string_view name,
+        std::string_view s,
+        const StorePathSet & references,
+        RepairFlag repair = NoRepair) = 0;
 
     /**
      * Add a mapping indicating that `deriver!outputName` maps to the output path
@@ -608,7 +618,7 @@ public:
     /* Return a string representing information about the path that
        can be loaded into the database using `nix-store --load-db' or
        `nix-store --register-validity'. */
-    string makeValidityRegistration(const StorePathSet & paths,
+    std::string makeValidityRegistration(const StorePathSet & paths,
         bool showDerivers, bool showHash);
 
     /* Write a JSON representation of store path metadata, such as the
@@ -910,7 +920,7 @@ struct RegisterStoreImplementation
 
 /* Display a set of paths in human-readable form (i.e., between quotes
    and separated by commas). */
-string showPaths(const PathSet & paths);
+std::string showPaths(const PathSet & paths);
 
 
 std::optional<ValidPathInfo> decodeValidPathInfo(
diff --git a/src/libutil/archive.cc b/src/libutil/archive.cc
index fdee643b1..eda004756 100644
--- a/src/libutil/archive.cc
+++ b/src/libutil/archive.cc
@@ -37,7 +37,7 @@ static GlobalConfig::Register rArchiveSettings(&archiveSettings);
 
 const std::string narVersionMagic1 = "nix-archive-1";
 
-static string caseHackSuffix = "~nix~case~hack~";
+static std::string caseHackSuffix = "~nix~case~hack~";
 
 PathFilter defaultPathFilter = [](const Path &) { return true; };
 
@@ -84,12 +84,12 @@ static void dump(const Path & path, Sink & sink, PathFilter & filter)
 
         /* If we're on a case-insensitive system like macOS, undo
            the case hack applied by restorePath(). */
-        std::map<string, string> unhacked;
+        std::map<std::string, std::string> unhacked;
         for (auto & i : readDirectory(path))
             if (archiveSettings.useCaseHack) {
-                string name(i.name);
+                std::string name(i.name);
                 size_t pos = i.name.find(caseHackSuffix);
-                if (pos != string::npos) {
+                if (pos != std::string::npos) {
                     debug(format("removing case hack suffix from '%1%'") % (path + "/" + i.name));
                     name.erase(pos);
                 }
@@ -124,13 +124,13 @@ void dumpPath(const Path & path, Sink & sink, PathFilter & filter)
 }
 
 
-void dumpString(const std::string & s, Sink & sink)
+void dumpString(std::string_view s, Sink & sink)
 {
     sink << narVersionMagic1 << "(" << "type" << "regular" << "contents" << s << ")";
 }
 
 
-static SerialisationError badArchive(string s)
+static SerialisationError badArchive(const std::string & s)
 {
     return SerialisationError("bad archive: " + s);
 }
@@ -171,7 +171,7 @@ static void parseContents(ParseSink & sink, Source & source, const Path & path)
 
 struct CaseInsensitiveCompare
 {
-    bool operator() (const string & a, const string & b) const
+    bool operator() (const std::string & a, const std::string & b) const
     {
         return strcasecmp(a.c_str(), b.c_str()) < 0;
     }
@@ -180,7 +180,7 @@ struct CaseInsensitiveCompare
 
 static void parse(ParseSink & sink, Source & source, const Path & path)
 {
-    string s;
+    std::string s;
 
     s = readString(source);
     if (s != "(") throw badArchive("expected open tag");
@@ -201,7 +201,7 @@ static void parse(ParseSink & sink, Source & source, const Path & path)
         else if (s == "type") {
             if (type != tpUnknown)
                 throw badArchive("multiple type fields");
-            string t = readString(source);
+            std::string t = readString(source);
 
             if (t == "regular") {
                 type = tpRegular;
@@ -232,7 +232,7 @@ static void parse(ParseSink & sink, Source & source, const Path & path)
         }
 
         else if (s == "entry" && type == tpDirectory) {
-            string name, prevName;
+            std::string name, prevName;
 
             s = readString(source);
             if (s != "(") throw badArchive("expected open tag");
@@ -246,7 +246,7 @@ static void parse(ParseSink & sink, Source & source, const Path & path)
                     break;
                 } else if (s == "name") {
                     name = readString(source);
-                    if (name.empty() || name == "." || name == ".." || name.find('/') != string::npos || name.find((char) 0) != string::npos)
+                    if (name.empty() || name == "." || name == ".." || name.find('/') != std::string::npos || name.find((char) 0) != std::string::npos)
                         throw Error("NAR contains invalid file name '%1%'", name);
                     if (name <= prevName)
                         throw Error("NAR directory is not sorted");
@@ -269,7 +269,7 @@ static void parse(ParseSink & sink, Source & source, const Path & path)
         }
 
         else if (s == "target" && type == tpSymlink) {
-            string target = readString(source);
+            std::string target = readString(source);
             sink.createSymlink(path, target);
         }
 
@@ -281,7 +281,7 @@ static void parse(ParseSink & sink, Source & source, const Path & path)
 
 void parseDump(ParseSink & sink, Source & source)
 {
-    string version;
+    std::string version;
     try {
         version = readString(source, narVersionMagic1.size());
     } catch (SerialisationError & e) {
@@ -345,7 +345,7 @@ struct RestoreSink : ParseSink
         writeFull(fd.get(), data);
     }
 
-    void createSymlink(const Path & path, const string & target) override
+    void createSymlink(const Path & path, const std::string & target) override
     {
         Path p = dstPath + path;
         nix::createSymlink(target, p);
diff --git a/src/libutil/archive.hh b/src/libutil/archive.hh
index 9e9e11b1a..fca351605 100644
--- a/src/libutil/archive.hh
+++ b/src/libutil/archive.hh
@@ -48,7 +48,7 @@ namespace nix {
 void dumpPath(const Path & path, Sink & sink,
     PathFilter & filter = defaultPathFilter);
 
-void dumpString(const std::string & s, Sink & sink);
+void dumpString(std::string_view s, Sink & sink);
 
 /* FIXME: fix this API, it sucks. */
 struct ParseSink
@@ -60,7 +60,7 @@ struct ParseSink
     virtual void preallocateContents(uint64_t size) { };
     virtual void receiveContents(std::string_view data) { };
 
-    virtual void createSymlink(const Path & path, const string & target) { };
+    virtual void createSymlink(const Path & path, const std::string & target) { };
 };
 
 /* If the NAR archive contains a single file at top-level, then save
@@ -82,7 +82,7 @@ struct RetrieveRegularNARSink : ParseSink
         sink(data);
     }
 
-    void createSymlink(const Path & path, const string & target) override
+    void createSymlink(const Path & path, const std::string & target) override
     {
         regular = false;
     }
diff --git a/src/libutil/args.cc b/src/libutil/args.cc
index a739d6b4e..f970c0e9e 100644
--- a/src/libutil/args.cc
+++ b/src/libutil/args.cc
@@ -76,13 +76,13 @@ void Args::parseCmdline(const Strings & _cmdline)
         /* Expand compound dash options (i.e., `-qlf' -> `-q -l -f',
            `-j3` -> `-j 3`). */
         if (!dashDash && arg.length() > 2 && arg[0] == '-' && arg[1] != '-' && isalpha(arg[1])) {
-            *pos = (string) "-" + arg[1];
+            *pos = (std::string) "-" + arg[1];
             auto next = pos; ++next;
             for (unsigned int j = 2; j < arg.length(); j++)
                 if (isalpha(arg[j]))
-                    cmdline.insert(next, (string) "-" + arg[j]);
+                    cmdline.insert(next, (std::string) "-" + arg[j]);
                 else {
-                    cmdline.insert(next, string(arg, j));
+                    cmdline.insert(next, std::string(arg, j));
                     break;
                 }
             arg = *pos;
@@ -139,7 +139,7 @@ bool Args::processFlag(Strings::iterator & pos, Strings::iterator end)
         return true;
     };
 
-    if (string(*pos, 0, 2) == "--") {
+    if (std::string(*pos, 0, 2) == "--") {
         if (auto prefix = needsCompletion(*pos)) {
             for (auto & [name, flag] : longFlags) {
                 if (!hiddenCategories.count(flag->category)
@@ -147,12 +147,12 @@ bool Args::processFlag(Strings::iterator & pos, Strings::iterator end)
                     completions->add("--" + name, flag->description);
             }
         }
-        auto i = longFlags.find(string(*pos, 2));
+        auto i = longFlags.find(std::string(*pos, 2));
         if (i == longFlags.end()) return false;
         return process("--" + i->first, *i->second);
     }
 
-    if (string(*pos, 0, 1) == "-" && pos->size() == 2) {
+    if (std::string(*pos, 0, 1) == "-" && pos->size() == 2) {
         auto c = (*pos)[1];
         auto i = shortFlags.find(c);
         if (i == shortFlags.end()) return false;
diff --git a/src/libutil/args.hh b/src/libutil/args.hh
index 76b1cfe92..fdd036f9a 100644
--- a/src/libutil/args.hh
+++ b/src/libutil/args.hh
@@ -158,7 +158,7 @@ public:
     }
 
     /* Expect a string argument. */
-    void expectArg(const std::string & label, string * dest, bool optional = false)
+    void expectArg(const std::string & label, std::string * dest, bool optional = false)
     {
         expectArgs({
             .label = label,
diff --git a/src/libutil/config.cc b/src/libutil/config.cc
index 8e05f1765..9bb412b4f 100644
--- a/src/libutil/config.cc
+++ b/src/libutil/config.cc
@@ -81,16 +81,16 @@ void AbstractConfig::applyConfig(const std::string & contents, const std::string
     unsigned int pos = 0;
 
     while (pos < contents.size()) {
-        string line;
+        std::string line;
         while (pos < contents.size() && contents[pos] != '\n')
             line += contents[pos++];
         pos++;
 
-        string::size_type hash = line.find('#');
-        if (hash != string::npos)
-            line = string(line, 0, hash);
+        auto hash = line.find('#');
+        if (hash != std::string::npos)
+            line = std::string(line, 0, hash);
 
-        auto tokens = tokenizeString<std::vector<string>>(line);
+        auto tokens = tokenizeString<std::vector<std::string>>(line);
         if (tokens.empty()) continue;
 
         if (tokens.size() < 2)
@@ -120,7 +120,7 @@ void AbstractConfig::applyConfig(const std::string & contents, const std::string
         if (tokens[1] != "=")
             throw UsageError("illegal configuration line '%1%' in '%2%'", line, path);
 
-        string name = tokens[0];
+        std::string name = tokens[0];
 
         auto i = tokens.begin();
         advance(i, 2);
@@ -132,7 +132,7 @@ void AbstractConfig::applyConfig(const std::string & contents, const std::string
 void AbstractConfig::applyConfigFile(const Path & path)
 {
     try {
-        string contents = readFile(path);
+        std::string contents = readFile(path);
         applyConfig(contents, path);
     } catch (SysError &) { }
 }
diff --git a/src/libutil/error.cc b/src/libutil/error.cc
index dd9678ee7..dcd2f82a5 100644
--- a/src/libutil/error.cc
+++ b/src/libutil/error.cc
@@ -17,7 +17,7 @@ BaseError & BaseError::addTrace(std::optional<ErrPos> e, hintformat hint)
 
 // c++ std::exception descendants must have a 'const char* what()' function.
 // This stringifies the error and caches it for use by what(), or similarly by msg().
-const string & BaseError::calcWhat() const
+const std::string & BaseError::calcWhat() const
 {
     if (what_.has_value())
         return *what_;
@@ -32,14 +32,14 @@ const string & BaseError::calcWhat() const
     }
 }
 
-std::optional<string> ErrorInfo::programName = std::nullopt;
+std::optional<std::string> ErrorInfo::programName = std::nullopt;
 
 std::ostream & operator<<(std::ostream & os, const hintformat & hf)
 {
     return os << hf.str();
 }
 
-string showErrPos(const ErrPos & errPos)
+std::string showErrPos(const ErrPos & errPos)
 {
     if (errPos.line > 0) {
         if (errPos.column > 0) {
@@ -68,7 +68,7 @@ std::optional<LinesOfCode> getCodeLines(const ErrPos & errPos)
 
             // count the newlines.
             int count = 0;
-            string line;
+            std::string line;
             int pl = errPos.line - 1;
             do
             {
@@ -100,7 +100,7 @@ std::optional<LinesOfCode> getCodeLines(const ErrPos & errPos)
         std::istringstream iss(errPos.file);
         // count the newlines.
         int count = 0;
-        string line;
+        std::string line;
         int pl = errPos.line - 1;
 
         LinesOfCode loc;
@@ -132,7 +132,7 @@ std::optional<LinesOfCode> getCodeLines(const ErrPos & errPos)
 
 // print lines of code to the ostream, indicating the error column.
 void printCodeLines(std::ostream & out,
-    const string & prefix,
+    const std::string & prefix,
     const ErrPos & errPos,
     const LinesOfCode & loc)
 {
diff --git a/src/libutil/error.hh b/src/libutil/error.hh
index 6fe5e4857..d55e1d701 100644
--- a/src/libutil/error.hh
+++ b/src/libutil/error.hh
@@ -61,16 +61,16 @@ typedef enum {
 
 // the lines of code surrounding an error.
 struct LinesOfCode {
-    std::optional<string> prevLineOfCode;
-    std::optional<string> errLineOfCode;
-    std::optional<string> nextLineOfCode;
+    std::optional<std::string> prevLineOfCode;
+    std::optional<std::string> errLineOfCode;
+    std::optional<std::string> nextLineOfCode;
 };
 
 // ErrPos indicates the location of an error in a nix file.
 struct ErrPos {
     int line = 0;
     int column = 0;
-    string file;
+    std::string file;
     FileOrigin origin;
 
     operator bool() const
@@ -80,7 +80,7 @@ struct ErrPos {
 
     // convert from the Pos struct, found in libexpr.
     template <class P>
-    ErrPos& operator=(const P &pos)
+    ErrPos & operator=(const P & pos)
     {
         origin = pos.origin;
         line = pos.line;
@@ -94,7 +94,7 @@ struct ErrPos {
     }
 
     template <class P>
-    ErrPos(const P &p)
+    ErrPos(const P & p)
     {
         *this = p;
     }
@@ -107,15 +107,15 @@ struct Trace {
 
 struct ErrorInfo {
     Verbosity level;
-    string name; // FIXME: rename
+    std::string name; // FIXME: rename
     hintformat msg;
     std::optional<ErrPos> errPos;
     std::list<Trace> traces;
 
-    static std::optional<string> programName;
+    static std::optional<std::string> programName;
 };
 
-std::ostream& showErrorInfo(std::ostream &out, const ErrorInfo &einfo, bool showTrace);
+std::ostream & showErrorInfo(std::ostream & out, const ErrorInfo & einfo, bool showTrace);
 
 /* BaseError should generally not be caught, as it has Interrupted as
    a subclass. Catch Error instead. */
@@ -124,8 +124,8 @@ class BaseError : public std::exception
 protected:
     mutable ErrorInfo err;
 
-    mutable std::optional<string> what_;
-    const string& calcWhat() const;
+    mutable std::optional<std::string> what_;
+    const std::string & calcWhat() const;
 
 public:
     unsigned int status = 1; // exit status
@@ -162,11 +162,11 @@ public:
     const char * what() const noexcept override { return calcWhat().c_str(); }
 #endif
 
-    const string & msg() const { return calcWhat(); }
+    const std::string & msg() const { return calcWhat(); }
     const ErrorInfo & info() const { calcWhat(); return err; }
 
     template<typename... Args>
-    BaseError & addTrace(std::optional<ErrPos> e, const string &fs, const Args & ... args)
+    BaseError & addTrace(std::optional<ErrPos> e, const std::string & fs, const Args & ... args)
     {
         return addTrace(e, hintfmt(fs, args...));
     }
diff --git a/src/libutil/fmt.hh b/src/libutil/fmt.hh
index a7126fb65..0821b3b74 100644
--- a/src/libutil/fmt.hh
+++ b/src/libutil/fmt.hh
@@ -10,7 +10,6 @@ namespace nix {
 
 
 /* Inherit some names from other namespaces for convenience. */
-using std::string;
 using boost::format;
 
 
@@ -21,8 +20,8 @@ struct nop { template<typename... T> nop(T...) {} };
 
 struct FormatOrString
 {
-    string s;
-    FormatOrString(const string & s) : s(s) { };
+    std::string s;
+    FormatOrString(std::string s) : s(std::move(s)) { };
     template<class F>
     FormatOrString(const F & f) : s(f.str()) { };
     FormatOrString(const char * s) : s(s) { };
@@ -102,7 +101,7 @@ std::ostream & operator<<(std::ostream & out, const normaltxt<T> & y)
 class hintformat
 {
 public:
-    hintformat(const string & format) : fmt(format)
+    hintformat(const std::string & format) : fmt(format)
     {
         fmt.exceptions(boost::io::all_error_bits ^
                        boost::io::too_many_args_bit ^
diff --git a/src/libutil/hash.cc b/src/libutil/hash.cc
index 6ed00d43c..a4d632161 100644
--- a/src/libutil/hash.cc
+++ b/src/libutil/hash.cc
@@ -66,31 +66,31 @@ bool Hash::operator < (const Hash & h) const
 }
 
 
-const string base16Chars = "0123456789abcdef";
+const std::string base16Chars = "0123456789abcdef";
 
 
-static string printHash16(const Hash & hash)
+static std::string printHash16(const Hash & hash)
 {
     char buf[hash.hashSize * 2];
     for (unsigned int i = 0; i < hash.hashSize; i++) {
         buf[i * 2] = base16Chars[hash.hash[i] >> 4];
         buf[i * 2 + 1] = base16Chars[hash.hash[i] & 0x0f];
     }
-    return string(buf, hash.hashSize * 2);
+    return std::string(buf, hash.hashSize * 2);
 }
 
 
 // omitted: E O U T
-const string base32Chars = "0123456789abcdfghijklmnpqrsvwxyz";
+const std::string base32Chars = "0123456789abcdfghijklmnpqrsvwxyz";
 
 
-static string printHash32(const Hash & hash)
+static std::string printHash32(const Hash & hash)
 {
     assert(hash.hashSize);
     size_t len = hash.base32Len();
     assert(len);
 
-    string s;
+    std::string s;
     s.reserve(len);
 
     for (int n = (int) len - 1; n >= 0; n--) {
@@ -107,7 +107,7 @@ static string printHash32(const Hash & hash)
 }
 
 
-string printHash16or32(const Hash & hash)
+std::string printHash16or32(const Hash & hash)
 {
     assert(hash.type);
     return hash.to_string(hash.type == htMD5 ? Base16 : Base32, false);
@@ -151,7 +151,8 @@ Hash Hash::parseSRI(std::string_view original) {
 }
 
 // Mutates the string to eliminate the prefixes when found
-static std::pair<std::optional<HashType>, bool> getParsedTypeAndSRI(std::string_view & rest) {
+static std::pair<std::optional<HashType>, bool> getParsedTypeAndSRI(std::string_view & rest)
+{
     bool isSRI = false;
 
     // Parse the has type before the separater, if there was one.
@@ -402,7 +403,7 @@ HashType parseHashType(std::string_view s)
         throw UsageError("unknown hash algorithm '%1%'", s);
 }
 
-string printHashType(HashType ht)
+std::string printHashType(HashType ht)
 {
     switch (ht) {
     case htMD5: return "md5";
diff --git a/src/libutil/hash.hh b/src/libutil/hash.hh
index dff46542f..56b5938b3 100644
--- a/src/libutil/hash.hh
+++ b/src/libutil/hash.hh
@@ -20,7 +20,7 @@ const int sha512HashSize = 64;
 
 extern std::set<std::string> hashTypes;
 
-extern const string base32Chars;
+extern const std::string base32Chars;
 
 enum Base : int { Base64, Base32, Base16, SRI };
 
@@ -110,7 +110,7 @@ public:
 Hash newHashAllowEmpty(std::string_view hashStr, std::optional<HashType> ht);
 
 /* Print a hash in base-16 if it's MD5, or base-32 otherwise. */
-string printHash16or32(const Hash & hash);
+std::string printHash16or32(const Hash & hash);
 
 /* Compute the hash of the given string. */
 Hash hashString(HashType ht, std::string_view s);
@@ -135,7 +135,7 @@ HashType parseHashType(std::string_view s);
 std::optional<HashType> parseHashTypeOpt(std::string_view s);
 
 /* And the reverse. */
-string printHashType(HashType ht);
+std::string printHashType(HashType ht);
 
 
 union Ctx;
diff --git a/src/libutil/logging.cc b/src/libutil/logging.cc
index f8a121ed1..74ee2f063 100644
--- a/src/libutil/logging.cc
+++ b/src/libutil/logging.cc
@@ -113,7 +113,7 @@ void warnOnce(bool & haveWarned, const FormatOrString & fs)
     }
 }
 
-void writeToStderr(const string & s)
+void writeToStderr(std::string_view s)
 {
     try {
         writeFull(STDERR_FILENO, s, false);
diff --git a/src/libutil/logging.hh b/src/libutil/logging.hh
index 5560d2bed..bd28036ae 100644
--- a/src/libutil/logging.hh
+++ b/src/libutil/logging.hh
@@ -216,6 +216,6 @@ inline void warn(const std::string & fs, const Args & ... args)
 
 void warnOnce(bool & haveWarned, const FormatOrString & fs);
 
-void writeToStderr(const string & s);
+void writeToStderr(std::string_view s);
 
 }
diff --git a/src/libutil/serialise.cc b/src/libutil/serialise.cc
index fe703de06..6445b3f1b 100644
--- a/src/libutil/serialise.cc
+++ b/src/libutil/serialise.cc
@@ -391,7 +391,7 @@ size_t readString(char * buf, size_t max, Source & source)
 }
 
 
-string readString(Source & source, size_t max)
+std::string readString(Source & source, size_t max)
 {
     auto len = readNum<size_t>(source);
     if (len > max) throw SerialisationError("string is too long");
@@ -401,7 +401,7 @@ string readString(Source & source, size_t max)
     return res;
 }
 
-Source & operator >> (Source & in, string & s)
+Source & operator >> (Source & in, std::string & s)
 {
     s = readString(in);
     return in;
diff --git a/src/libutil/serialise.hh b/src/libutil/serialise.hh
index fdd35aa00..13da26c6a 100644
--- a/src/libutil/serialise.hh
+++ b/src/libutil/serialise.hh
@@ -364,10 +364,10 @@ inline uint64_t readLongLong(Source & source)
 
 void readPadding(size_t len, Source & source);
 size_t readString(char * buf, size_t max, Source & source);
-string readString(Source & source, size_t max = std::numeric_limits<size_t>::max());
+std::string readString(Source & source, size_t max = std::numeric_limits<size_t>::max());
 template<class T> T readStrings(Source & source);
 
-Source & operator >> (Source & in, string & s);
+Source & operator >> (Source & in, std::string & s);
 
 template<typename T>
 Source & operator >> (Source & in, T & n)
diff --git a/src/libutil/tests/url.cc b/src/libutil/tests/url.cc
index aff58e9ee..f20e2dc41 100644
--- a/src/libutil/tests/url.cc
+++ b/src/libutil/tests/url.cc
@@ -5,9 +5,9 @@ namespace nix {
 
 /* ----------- tests for url.hh --------------------------------------------------*/
 
-    string print_map(std::map<string, string> m) {
-        std::map<string, string>::iterator it;
-        string s = "{ ";
+    std::string print_map(std::map<std::string, std::string> m) {
+        std::map<std::string, std::string>::iterator it;
+        std::string s = "{ ";
         for (it = m.begin(); it != m.end(); ++it) {
             s += "{ ";
             s += it->first;
@@ -262,21 +262,21 @@ namespace nix {
      * --------------------------------------------------------------------------*/
 
     TEST(percentDecode, decodesUrlEncodedString) {
-        string s = "==@==";
-        string d = percentDecode("%3D%3D%40%3D%3D");
+        std::string s = "==@==";
+        std::string d = percentDecode("%3D%3D%40%3D%3D");
         ASSERT_EQ(d, s);
     }
 
     TEST(percentDecode, multipleDecodesAreIdempotent) {
-        string once = percentDecode("%3D%3D%40%3D%3D");
-        string twice = percentDecode(once);
+        std::string once = percentDecode("%3D%3D%40%3D%3D");
+        std::string twice = percentDecode(once);
 
         ASSERT_EQ(once, twice);
     }
 
     TEST(percentDecode, trailingPercent) {
-        string s = "==@==%";
-        string d = percentDecode("%3D%3D%40%3D%3D%25");
+        std::string s = "==@==%";
+        std::string d = percentDecode("%3D%3D%40%3D%3D%25");
 
         ASSERT_EQ(d, s);
     }
diff --git a/src/libutil/types.hh b/src/libutil/types.hh
index bea2673ca..00ba567c6 100644
--- a/src/libutil/types.hh
+++ b/src/libutil/types.hh
@@ -14,6 +14,7 @@ namespace nix {
 typedef std::list<std::string> Strings;
 typedef std::set<std::string> StringSet;
 typedef std::map<std::string, std::string> StringMap;
+typedef std::map<std::string, std::string> StringPairs;
 
 /* Paths are just strings. */
 typedef std::string Path;
diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index b172e0554..88c5ae806 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -110,13 +110,13 @@ Path canonPath(PathView path, bool resolveSymlinks)
 {
     assert(path != "");
 
-    string s;
+    std::string s;
     s.reserve(256);
 
     if (path[0] != '/')
         throw Error("not an absolute path: '%1%'", path);
 
-    string temp;
+    std::string temp;
 
     /* Count the number of times we follow a symlink and stop at some
        arbitrary (but high) limit to prevent infinite loops. */
@@ -142,7 +142,7 @@ Path canonPath(PathView path, bool resolveSymlinks)
         /* Normal component; copy it. */
         else {
             s += '/';
-            if (const auto slash = path.find('/'); slash == string::npos) {
+            if (const auto slash = path.find('/'); slash == std::string::npos) {
                 s += path;
                 path = {};
             } else {
@@ -175,7 +175,7 @@ Path canonPath(PathView path, bool resolveSymlinks)
 Path dirOf(const PathView path)
 {
     Path::size_type pos = path.rfind('/');
-    if (pos == string::npos)
+    if (pos == std::string::npos)
         return ".";
     return pos == 0 ? "/" : Path(path, 0, pos);
 }
@@ -191,7 +191,7 @@ std::string_view baseNameOf(std::string_view path)
         last -= 1;
 
     auto pos = path.rfind('/', last);
-    if (pos == string::npos)
+    if (pos == std::string::npos)
         pos = 0;
     else
         pos += 1;
@@ -249,7 +249,7 @@ Path readLink(const Path & path)
             else
                 throw SysError("reading symbolic link '%1%'", path);
         else if (rlSize < bufSize)
-            return string(buf.data(), rlSize);
+            return std::string(buf.data(), rlSize);
     }
 }
 
@@ -269,7 +269,7 @@ DirEntries readDirectory(DIR *dir, const Path & path)
     struct dirent * dirent;
     while (errno = 0, dirent = readdir(dir)) { /* sic */
         checkInterrupt();
-        string name = dirent->d_name;
+        std::string name = dirent->d_name;
         if (name == "." || name == "..") continue;
         entries.emplace_back(name, dirent->d_ino,
 #ifdef HAVE_STRUCT_DIRENT_D_TYPE
@@ -303,7 +303,7 @@ unsigned char getFileType(const Path & path)
 }
 
 
-string readFile(int fd)
+std::string readFile(int fd)
 {
     struct stat st;
     if (fstat(fd, &st) == -1)
@@ -313,7 +313,7 @@ string readFile(int fd)
 }
 
 
-string readFile(const Path & path)
+std::string readFile(const Path & path)
 {
     AutoCloseFD fd = open(path.c_str(), O_RDONLY | O_CLOEXEC);
     if (!fd)
@@ -366,9 +366,9 @@ void writeFile(const Path & path, Source & source, mode_t mode)
     }
 }
 
-string readLine(int fd)
+std::string readLine(int fd)
 {
-    string s;
+    std::string s;
     while (1) {
         checkInterrupt();
         char ch;
@@ -387,7 +387,7 @@ string readLine(int fd)
 }
 
 
-void writeLine(int fd, string s)
+void writeLine(int fd, std::string s)
 {
     s += '\n';
     writeFull(fd, s);
@@ -398,7 +398,7 @@ static void _deletePath(int parentfd, const Path & path, uint64_t & bytesFreed)
 {
     checkInterrupt();
 
-    string name(baseNameOf(path));
+    std::string name(baseNameOf(path));
 
     struct stat st;
     if (fstatat(parentfd, name.c_str(), &st, AT_SYMLINK_NOFOLLOW) == -1) {
@@ -566,8 +566,8 @@ Path getConfigDir()
 std::vector<Path> getConfigDirs()
 {
     Path configHome = getConfigDir();
-    string configDirs = getEnv("XDG_CONFIG_DIRS").value_or("/etc/xdg");
-    std::vector<Path> result = tokenizeString<std::vector<string>>(configDirs, ":");
+    auto configDirs = getEnv("XDG_CONFIG_DIRS").value_or("/etc/xdg");
+    std::vector<Path> result = tokenizeString<std::vector<std::string>>(configDirs, ":");
     result.insert(result.begin(), configHome);
     return result;
 }
@@ -670,7 +670,7 @@ void writeFull(int fd, std::string_view s, bool allowInterrupts)
 }
 
 
-string drainFD(int fd, bool block, const size_t reserveSize)
+std::string drainFD(int fd, bool block, const size_t reserveSize)
 {
     // the parser needs two extra bytes to append terminating characters, other users will
     // not care very much about the extra memory.
@@ -719,7 +719,7 @@ void drainFD(int fd, Sink & sink, bool block)
 
 AutoDelete::AutoDelete() : del{false} {}
 
-AutoDelete::AutoDelete(const string & p, bool recursive) : path(p)
+AutoDelete::AutoDelete(const std::string & p, bool recursive) : path(p)
 {
     del = true;
     this->recursive = recursive;
@@ -1036,7 +1036,7 @@ std::vector<char *> stringsToCharPtrs(const Strings & ss)
     return res;
 }
 
-string runProgram(Path program, bool searchPath, const Strings & args,
+std::string runProgram(Path program, bool searchPath, const Strings & args,
     const std::optional<std::string> & input)
 {
     auto res = runProgram(RunOptions {.program = program, .searchPath = searchPath, .args = args, .input = input});
@@ -1238,11 +1238,11 @@ void _interrupted()
 template<class C> C tokenizeString(std::string_view s, std::string_view separators)
 {
     C result;
-    string::size_type pos = s.find_first_not_of(separators, 0);
-    while (pos != string::npos) {
-        string::size_type end = s.find_first_of(separators, pos + 1);
-        if (end == string::npos) end = s.size();
-        result.insert(result.end(), string(s, pos, end - pos));
+    auto pos = s.find_first_not_of(separators, 0);
+    while (pos != std::string::npos) {
+        auto end = s.find_first_of(separators, pos + 1);
+        if (end == std::string::npos) end = s.size();
+        result.insert(result.end(), std::string(s, pos, end - pos));
         pos = s.find_first_not_of(separators, end);
     }
     return result;
@@ -1250,29 +1250,30 @@ template<class C> C tokenizeString(std::string_view s, std::string_view separato
 
 template Strings tokenizeString(std::string_view s, std::string_view separators);
 template StringSet tokenizeString(std::string_view s, std::string_view separators);
-template std::vector<string> tokenizeString(std::string_view s, std::string_view separators);
+template std::vector<std::string> tokenizeString(std::string_view s, std::string_view separators);
 
 
-string chomp(std::string_view s)
+std::string chomp(std::string_view s)
 {
     size_t i = s.find_last_not_of(" \n\r\t");
-    return i == string::npos ? "" : string(s, 0, i + 1);
+    return i == std::string_view::npos ? "" : std::string(s, 0, i + 1);
 }
 
 
-string trim(const string & s, const string & whitespace)
+std::string trim(std::string_view s, std::string_view whitespace)
 {
     auto i = s.find_first_not_of(whitespace);
-    if (i == string::npos) return "";
+    if (i == std::string_view::npos) return "";
     auto j = s.find_last_not_of(whitespace);
-    return string(s, i, j == string::npos ? j : j - i + 1);
+    return std::string(s, i, j == std::string::npos ? j : j - i + 1);
 }
 
 
-string replaceStrings(std::string_view s,
-    const std::string & from, const std::string & to)
+std::string replaceStrings(
+    std::string res,
+    std::string_view from,
+    std::string_view to)
 {
-    string res(s);
     if (from.empty()) return res;
     size_t pos = 0;
     while ((pos = res.find(from, pos)) != std::string::npos) {
@@ -1283,20 +1284,19 @@ string replaceStrings(std::string_view s,
 }
 
 
-std::string rewriteStrings(const std::string & _s, const StringMap & rewrites)
+std::string rewriteStrings(std::string s, const StringMap & rewrites)
 {
-    auto s = _s;
     for (auto & i : rewrites) {
         if (i.first == i.second) continue;
         size_t j = 0;
-        while ((j = s.find(i.first, j)) != string::npos)
+        while ((j = s.find(i.first, j)) != std::string::npos)
             s.replace(j, i.first.size(), i.second);
     }
     return s;
 }
 
 
-string statusToString(int status)
+std::string statusToString(int status)
 {
     if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
         if (WIFEXITED(status))
@@ -1448,9 +1448,9 @@ std::string filterANSIEscapes(const std::string & s, bool filterAll, unsigned in
 
 constexpr char base64Chars[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 
-string base64Encode(std::string_view s)
+std::string base64Encode(std::string_view s)
 {
-    string res;
+    std::string res;
     int data = 0, nbits = 0;
 
     for (char c : s) {
@@ -1469,7 +1469,7 @@ string base64Encode(std::string_view s)
 }
 
 
-string base64Decode(std::string_view s)
+std::string base64Decode(std::string_view s)
 {
     constexpr char npos = -1;
     constexpr std::array<char, 256> base64DecodeChars = [&]() {
@@ -1481,7 +1481,7 @@ string base64Decode(std::string_view s)
         return result;
     }();
 
-    string res;
+    std::string res;
     unsigned int d = 0, bits = 0;
 
     for (char c : s) {
@@ -1835,7 +1835,7 @@ void connect(int fd, const std::string & path)
 }
 
 
-string showBytes(uint64_t bytes)
+std::string showBytes(uint64_t bytes)
 {
     return fmt("%.2f MiB", bytes / (1024.0 * 1024.0));
 }
@@ -1846,7 +1846,7 @@ void commonChildInit(Pipe & logPipe)
 {
     logger = makeSimpleLogger();
 
-    const static string pathNullDevice = "/dev/null";
+    const static std::string pathNullDevice = "/dev/null";
     restoreProcessContext(false);
 
     /* Put the child in a separate session (and thus a separate
diff --git a/src/libutil/util.hh b/src/libutil/util.hh
index a949e6424..20591952d 100644
--- a/src/libutil/util.hh
+++ b/src/libutil/util.hh
@@ -92,11 +92,11 @@ bool isLink(const Path & path);
    removed. */
 struct DirEntry
 {
-    string name;
+    std::string name;
     ino_t ino;
     unsigned char type; // one of DT_*
-    DirEntry(const string & name, ino_t ino, unsigned char type)
-        : name(name), ino(ino), type(type) { }
+    DirEntry(std::string name, ino_t ino, unsigned char type)
+        : name(std::move(name)), ino(ino), type(type) { }
 };
 
 typedef std::vector<DirEntry> DirEntries;
@@ -106,8 +106,8 @@ DirEntries readDirectory(const Path & path);
 unsigned char getFileType(const Path & path);
 
 /* Read the contents of a file into a string. */
-string readFile(int fd);
-string readFile(const Path & path);
+std::string readFile(int fd);
+std::string readFile(const Path & path);
 void readFile(const Path & path, Sink & sink);
 
 /* Write a string to a file. */
@@ -116,10 +116,10 @@ void writeFile(const Path & path, std::string_view s, mode_t mode = 0666);
 void writeFile(const Path & path, Source & source, mode_t mode = 0666);
 
 /* Read a line from a file descriptor. */
-string readLine(int fd);
+std::string readLine(int fd);
 
 /* Write a line to a file descriptor. */
-void writeLine(int fd, string s);
+void writeLine(int fd, std::string s);
 
 /* Delete a path; i.e., in the case of a directory, it is deleted
    recursively. It's not an error if the path does not exist. The
@@ -170,7 +170,7 @@ MakeError(EndOfFile, Error);
 
 
 /* Read a file descriptor until EOF occurs. */
-string drainFD(int fd, bool block = true, const size_t reserveSize=0);
+std::string drainFD(int fd, bool block = true, const size_t reserveSize=0);
 
 void drainFD(int fd, Sink & sink, bool block = true);
 
@@ -268,7 +268,7 @@ void killUser(uid_t uid);
    pid to the caller. */
 struct ProcessOptions
 {
-    string errorPrefix = "";
+    std::string errorPrefix = "";
     bool dieWithParent = true;
     bool runExitHandlers = false;
     bool allowVfork = false;
@@ -279,7 +279,7 @@ pid_t startProcess(std::function<void()> fun, const ProcessOptions & options = P
 
 /* Run a program and return its stdout in a string (i.e., like the
    shell backtick operator). */
-string runProgram(Path program, bool searchPath = false,
+std::string runProgram(Path program, bool searchPath = false,
     const Strings & args = Strings(),
     const std::optional<std::string> & input = {});
 
@@ -378,12 +378,12 @@ template<class C> C tokenizeString(std::string_view s, std::string_view separato
 /* Concatenate the given strings with a separator between the
    elements. */
 template<class C>
-string concatStringsSep(const std::string_view sep, const C & ss)
+std::string concatStringsSep(const std::string_view sep, const C & ss)
 {
     size_t size = 0;
     // need a cast to string_view since this is also called with Symbols
     for (const auto & s : ss) size += sep.size() + std::string_view(s).size();
-    string s;
+    std::string s;
     s.reserve(size);
     for (auto & i : ss) {
         if (s.size() != 0) s += sep;
@@ -394,7 +394,7 @@ string concatStringsSep(const std::string_view sep, const C & ss)
 
 template<class ... Parts>
 auto concatStrings(Parts && ... parts)
-    -> std::enable_if_t<(... && std::is_convertible_v<Parts, std::string_view>), string>
+    -> std::enable_if_t<(... && std::is_convertible_v<Parts, std::string_view>), std::string>
 {
     std::string_view views[sizeof...(parts)] = { parts... };
     return concatStringsSep({}, views);
@@ -413,24 +413,26 @@ template<class C> Strings quoteStrings(const C & c)
 
 /* Remove trailing whitespace from a string. FIXME: return
    std::string_view. */
-string chomp(std::string_view s);
+std::string chomp(std::string_view s);
 
 
 /* Remove whitespace from the start and end of a string. */
-string trim(const string & s, const string & whitespace = " \n\r\t");
+std::string trim(std::string_view s, std::string_view whitespace = " \n\r\t");
 
 
 /* Replace all occurrences of a string inside another string. */
-string replaceStrings(std::string_view s,
-    const std::string & from, const std::string & to);
+std::string replaceStrings(
+    std::string s,
+    std::string_view from,
+    std::string_view to);
 
 
-std::string rewriteStrings(const std::string & s, const StringMap & rewrites);
+std::string rewriteStrings(std::string s, const StringMap & rewrites);
 
 
 /* Convert the exit status of a child as returned by wait() into an
    error string. */
-string statusToString(int status);
+std::string statusToString(int status);
 
 bool statusOk(int status);
 
@@ -525,8 +527,8 @@ std::string filterANSIEscapes(const std::string & s,
 
 
 /* Base64 encoding/decoding. */
-string base64Encode(std::string_view s);
-string base64Decode(std::string_view s);
+std::string base64Encode(std::string_view s);
+std::string base64Decode(std::string_view s);
 
 
 /* Remove common leading whitespace from the lines in the string
diff --git a/src/nix-build/nix-build.cc b/src/nix-build/nix-build.cc
index aeabdcdd4..3d189f934 100755
--- a/src/nix-build/nix-build.cc
+++ b/src/nix-build/nix-build.cc
@@ -32,11 +32,11 @@ extern char * * environ __attribute__((weak));
 /* Recreate the effect of the perl shellwords function, breaking up a
  * string into arguments like a shell word, including escapes
  */
-std::vector<string> shellwords(const string & s)
+static std::vector<std::string> shellwords(const std::string & s)
 {
     std::regex whitespace("^(\\s+).*");
     auto begin = s.cbegin();
-    std::vector<string> res;
+    std::vector<std::string> res;
     std::string cur;
     enum state {
         sBegin,
@@ -96,14 +96,14 @@ static void main_nix_build(int argc, char * * argv)
 
     auto inShebang = false;
     std::string script;
-    std::vector<string> savedArgs;
+    std::vector<std::string> savedArgs;
 
     AutoDelete tmpDir(createTempDir("", myName));
 
     std::string outLink = "./result";
 
     // List of environment variables kept for --pure
-    std::set<string> keepVars{
+    std::set<std::string> keepVars{
         "HOME", "XDG_RUNTIME_DIR", "USER", "LOGNAME", "DISPLAY",
         "WAYLAND_DISPLAY", "WAYLAND_SOCKET", "PATH", "TERM", "IN_NIX_SHELL",
         "NIX_SHELL_PRESERVE_PROMPT", "TZ", "PAGER", "NIX_BUILD_SHELL", "SHLVL",
@@ -384,7 +384,9 @@ static void main_nix_build(int argc, char * * argv)
         // Build or fetch all dependencies of the derivation.
         for (const auto & input : drv.inputDrvs)
             if (std::all_of(envExclude.cbegin(), envExclude.cend(),
-                    [&](const string & exclude) { return !std::regex_search(store->printStorePath(input.first), std::regex(exclude)); }))
+                    [&](const std::string & exclude) {
+                        return !std::regex_search(store->printStorePath(input.first), std::regex(exclude));
+                    }))
             {
                 pathsToBuild.push_back({input.first, input.second});
                 pathsToCopy.insert(input.first);
@@ -437,7 +439,7 @@ static void main_nix_build(int argc, char * * argv)
         for (auto & var : drv.env)
             if (passAsFile.count(var.first)) {
                 keepTmp = true;
-                string fn = ".attr-" + std::to_string(fileNr++);
+                auto fn = ".attr-" + std::to_string(fileNr++);
                 Path p = (Path) tmpDir + "/" + fn;
                 writeFile(p, var.second);
                 env[var.first + "Path"] = p;
@@ -514,7 +516,7 @@ static void main_nix_build(int argc, char * * argv)
                 (pure ? "" : "PATH=$PATH:$p; unset p; "),
                 shellEscape(dirOf(*shell)),
                 shellEscape(*shell),
-                (getenv("TZ") ? (string("export TZ=") + shellEscape(getenv("TZ")) + "; ") : ""),
+                (getenv("TZ") ? (std::string("export TZ=") + shellEscape(getenv("TZ")) + "; ") : ""),
                 envCommand);
         vomit("Sourcing nix-shell with file %s and contents:\n%s", rcfile, rc);
         writeFile(rcfile, rc);
diff --git a/src/nix-channel/nix-channel.cc b/src/nix-channel/nix-channel.cc
index eae15885a..f46b90b90 100755
--- a/src/nix-channel/nix-channel.cc
+++ b/src/nix-channel/nix-channel.cc
@@ -11,7 +11,7 @@
 
 using namespace nix;
 
-typedef std::map<string,string> Channels;
+typedef std::map<std::string, std::string> Channels;
 
 static Channels channels;
 static Path channelsList;
@@ -22,11 +22,11 @@ static void readChannels()
     if (!pathExists(channelsList)) return;
     auto channelsFile = readFile(channelsList);
 
-    for (const auto & line : tokenizeString<std::vector<string>>(channelsFile, "\n")) {
+    for (const auto & line : tokenizeString<std::vector<std::string>>(channelsFile, "\n")) {
         chomp(line);
         if (std::regex_search(line, std::regex("^\\s*\\#")))
             continue;
-        auto split = tokenizeString<std::vector<string>>(line, " ");
+        auto split = tokenizeString<std::vector<std::string>>(line, " ");
         auto url = std::regex_replace(split[0], std::regex("/*$"), "");
         auto name = split.size() > 1 ? split[1] : std::string(baseNameOf(url));
         channels[name] = url;
@@ -44,7 +44,7 @@ static void writeChannels()
 }
 
 // Adds a channel.
-static void addChannel(const string & url, const string & name)
+static void addChannel(const std::string & url, const std::string & name)
 {
     if (!regex_search(url, std::regex("^(file|http|https)://")))
         throw Error("invalid channel URL '%1%'", url);
@@ -58,7 +58,7 @@ static void addChannel(const string & url, const string & name)
 static Path profile;
 
 // Remove a channel.
-static void removeChannel(const string & name)
+static void removeChannel(const std::string & name)
 {
     readChannels();
     channels.erase(name);
@@ -96,7 +96,7 @@ static void update(const StringSet & channelNames)
         std::smatch match;
         auto urlBase = std::string(baseNameOf(url));
         if (std::regex_search(urlBase, match, std::regex("(-\\d.*)$")))
-            cname = cname + (string) match[1];
+            cname = cname + (std::string) match[1];
 
         std::string extraAttrs;
 
@@ -176,7 +176,7 @@ static int main_nix_channel(int argc, char ** argv)
             cUpdate,
             cRollback
         } cmd = cNone;
-        std::vector<string> args;
+        std::vector<std::string> args;
         parseCmdLine(argc, argv, [&](Strings::iterator & arg, const Strings::iterator & end) {
             if (*arg == "--help") {
                 showManPage("nix-channel");
diff --git a/src/nix-collect-garbage/nix-collect-garbage.cc b/src/nix-collect-garbage/nix-collect-garbage.cc
index 4f953fab4..48c030b18 100644
--- a/src/nix-collect-garbage/nix-collect-garbage.cc
+++ b/src/nix-collect-garbage/nix-collect-garbage.cc
@@ -36,7 +36,7 @@ void removeOldGenerations(std::string dir)
             } catch (SysError & e) {
                 if (e.errNo == ENOENT) continue;
             }
-            if (link.find("link") != string::npos) {
+            if (link.find("link") != std::string::npos) {
                 printInfo(format("removing old generations of profile %1%") % path);
                 if (deleteOlderThan != "")
                     deleteGenerationsOlderThan(path, deleteOlderThan, dryRun);
diff --git a/src/nix-env/nix-env.cc b/src/nix-env/nix-env.cc
index f83edb6a1..12e08bbe1 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix-env/nix-env.cc
@@ -46,7 +46,7 @@ struct InstallSourceInfo
     InstallSourceType type;
     Path nixExprPath; /* for srcNixExprDrvs, srcNixExprs */
     Path profile; /* for srcProfile */
-    string systemFilter; /* for srcNixExprDrvs */
+    std::string systemFilter; /* for srcNixExprDrvs */
     Bindings * autoArgs;
 };
 
@@ -59,7 +59,7 @@ struct Globals
     bool dryRun;
     bool preserveInstalled;
     bool removeAll;
-    string forceName;
+    std::string forceName;
     bool prebuiltOnly;
 };
 
@@ -68,8 +68,8 @@ typedef void (* Operation) (Globals & globals,
     Strings opFlags, Strings opArgs);
 
 
-static string needArg(Strings::iterator & i,
-    Strings & args, const string & arg)
+static std::string needArg(Strings::iterator & i,
+    Strings & args, const std::string & arg)
 {
     if (i == args.end()) throw UsageError("'%1%' requires an argument", arg);
     return *i++;
@@ -77,7 +77,7 @@ static string needArg(Strings::iterator & i,
 
 
 static bool parseInstallSourceOptions(Globals & globals,
-    Strings::iterator & i, Strings & args, const string & arg)
+    Strings::iterator & i, Strings & args, const std::string & arg)
 {
     if (arg == "--from-expression" || arg == "-E")
         globals.instSource.type = srcNixExprs;
@@ -124,9 +124,9 @@ static void getAllExprs(EvalState & state,
                otherwise the attribute cannot be selected with the
                `-A' option.  Useful if you want to stick a Nix
                expression directly in ~/.nix-defexpr. */
-            string attrName = i;
+            std::string attrName = i;
             if (hasSuffix(attrName, ".nix"))
-                attrName = string(attrName, 0, attrName.size() - 4);
+                attrName = std::string(attrName, 0, attrName.size() - 4);
             if (!seen.insert(attrName).second) {
                 printError("warning: name collision in input Nix expressions, skipping '%1%'", path2);
                 continue;
@@ -175,8 +175,8 @@ static void loadSourceExpr(EvalState & state, const Path & path, Value & v)
 
 
 static void loadDerivations(EvalState & state, Path nixExprPath,
-    string systemFilter, Bindings & autoArgs,
-    const string & pathPrefix, DrvInfos & elems)
+    std::string systemFilter, Bindings & autoArgs,
+    const std::string & pathPrefix, DrvInfos & elems)
 {
     Value vRoot;
     loadSourceExpr(state, nixExprPath, vRoot);
@@ -343,9 +343,9 @@ static DrvInfos filterBySelector(EvalState & state, const DrvInfos & allElems,
 
         if (selector.hits == 0 && selector.fullName != "*") {
             const auto prefixHits = searchByPrefix(allElems, selector.name);
-            
+
             if (prefixHits.empty()) {
-                throw Error("selector '%1%' matches no derivations", selector.fullName);    
+                throw Error("selector '%1%' matches no derivations", selector.fullName);
             } else {
                 std::string suggestionMessage = ", maybe you meant:";
                 for (const auto & drvName : prefixHits) {
@@ -360,9 +360,9 @@ static DrvInfos filterBySelector(EvalState & state, const DrvInfos & allElems,
 }
 
 
-static bool isPath(const string & s)
+static bool isPath(std::string_view s)
 {
-    return s.find('/') != string::npos;
+    return s.find('/') != std::string_view::npos;
 }
 
 
@@ -433,8 +433,8 @@ static void queryInstSources(EvalState & state,
                     auto outputs = state.store->queryDerivationOutputMap(path);
                     elem.setOutPath(state.store->printStorePath(outputs.at("out")));
                     if (name.size() >= drvExtension.size() &&
-                        string(name, name.size() - drvExtension.size()) == drvExtension)
-                        name = string(name, 0, name.size() - drvExtension.size());
+                        std::string(name, name.size() - drvExtension.size()) == drvExtension)
+                        name = name.substr(0, name.size() - drvExtension.size());
                 }
                 else elem.setOutPath(state.store->printStorePath(path));
 
@@ -515,7 +515,7 @@ static void installDerivations(Globals & globals,
 
 
     while (true) {
-        string lockToken = optimisticLockProfile(profile);
+        auto lockToken = optimisticLockProfile(profile);
 
         DrvInfos allElems(newElems);
 
@@ -551,7 +551,7 @@ static void installDerivations(Globals & globals,
 static void opInstall(Globals & globals, Strings opFlags, Strings opArgs)
 {
     for (Strings::iterator i = opFlags.begin(); i != opFlags.end(); ) {
-        string arg = *i++;
+        auto arg = *i++;
         if (parseInstallSourceOptions(globals, i, opFlags, arg)) ;
         else if (arg == "--preserve-installed" || arg == "-P")
             globals.preserveInstalled = true;
@@ -578,7 +578,7 @@ static void upgradeDerivations(Globals & globals,
        name and a higher version number. */
 
     while (true) {
-        string lockToken = optimisticLockProfile(globals.profile);
+        auto lockToken = optimisticLockProfile(globals.profile);
 
         DrvInfos installedElems = queryInstalled(*globals.state, globals.profile);
 
@@ -606,7 +606,7 @@ static void upgradeDerivations(Globals & globals,
                    take the one with the highest version.
                    Do not upgrade if it would decrease the priority. */
                 DrvInfos::iterator bestElem = availElems.end();
-                string bestVersion;
+                std::string bestVersion;
                 for (auto j = availElems.begin(); j != availElems.end(); ++j) {
                     if (comparePriorities(*globals.state, i, *j) > 0)
                         continue;
@@ -662,7 +662,7 @@ static void opUpgrade(Globals & globals, Strings opFlags, Strings opArgs)
 {
     UpgradeType upgradeType = utLt;
     for (Strings::iterator i = opFlags.begin(); i != opFlags.end(); ) {
-        string arg = *i++;
+        std::string arg = *i++;
         if (parseInstallSourceOptions(globals, i, opFlags, arg)) ;
         else if (arg == "--lt") upgradeType = utLt;
         else if (arg == "--leq") upgradeType = utLeq;
@@ -676,7 +676,7 @@ static void opUpgrade(Globals & globals, Strings opFlags, Strings opArgs)
 
 
 static void setMetaFlag(EvalState & state, DrvInfo & drv,
-    const string & name, const string & value)
+    const std::string & name, const std::string & value)
 {
     auto v = state.allocValue();
     v->mkString(value);
@@ -692,12 +692,12 @@ static void opSetFlag(Globals & globals, Strings opFlags, Strings opArgs)
         throw UsageError("not enough arguments to '--set-flag'");
 
     Strings::iterator arg = opArgs.begin();
-    string flagName = *arg++;
-    string flagValue = *arg++;
+    std::string flagName = *arg++;
+    std::string flagValue = *arg++;
     DrvNames selectors = drvNamesFromArgs(Strings(arg, opArgs.end()));
 
     while (true) {
-        string lockToken = optimisticLockProfile(globals.profile);
+        std::string lockToken = optimisticLockProfile(globals.profile);
 
         DrvInfos installedElems = queryInstalled(*globals.state, globals.profile);
 
@@ -728,7 +728,7 @@ static void opSet(Globals & globals, Strings opFlags, Strings opArgs)
     if (!store2) throw Error("--set is not supported for this Nix store");
 
     for (Strings::iterator i = opFlags.begin(); i != opFlags.end(); ) {
-        string arg = *i++;
+        std::string arg = *i++;
         if (parseInstallSourceOptions(globals, i, opFlags, arg)) ;
         else throw UsageError("unknown flag '%1%'", arg);
     }
@@ -769,7 +769,7 @@ static void uninstallDerivations(Globals & globals, Strings & selectors,
     Path & profile)
 {
     while (true) {
-        string lockToken = optimisticLockProfile(profile);
+        auto lockToken = optimisticLockProfile(profile);
 
         DrvInfos workingElems = queryInstalled(*globals.state, profile);
 
@@ -855,11 +855,11 @@ void printTable(Table & table)
         Strings::iterator j;
         size_t column;
         for (j = i.begin(), column = 0; j != i.end(); ++j, ++column) {
-            string s = *j;
+            std::string s = *j;
             replace(s.begin(), s.end(), '\n', ' ');
             cout << s;
             if (column < nrColumns - 1)
-                cout << string(widths[column] - s.size() + 2, ' ');
+                cout << std::string(widths[column] - s.size() + 2, ' ');
         }
         cout << std::endl;
     }
@@ -876,7 +876,7 @@ void printTable(Table & table)
 typedef enum { cvLess, cvEqual, cvGreater, cvUnavail } VersionDiff;
 
 static VersionDiff compareVersionAgainstSet(
-    const DrvInfo & elem, const DrvInfos & elems, string & version)
+    const DrvInfo & elem, const DrvInfos & elems, std::string & version)
 {
     DrvName name(elem.queryName());
 
@@ -958,7 +958,7 @@ static void queryJSON(Globals & globals, std::vector<DrvInfo> & elems, bool prin
 static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
 {
     Strings remaining;
-    string attrPath;
+    std::string attrPath;
 
     bool printStatus = false;
     bool printName = true;
@@ -977,7 +977,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
     settings.readOnlyMode = true; /* makes evaluation a bit faster */
 
     for (Strings::iterator i = opFlags.begin(); i != opFlags.end(); ) {
-        string arg = *i++;
+        auto arg = *i++;
         if (arg == "--status" || arg == "-s") printStatus = true;
         else if (arg == "--no-name") printName = false;
         else if (arg == "--system") printSystem = true;
@@ -1094,7 +1094,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                     attrs["substitutable"] = hasSubs ? "1" : "0";
                 } else
                     columns.push_back(
-                        (string) (isInstalled ? "I" : "-")
+                        (std::string) (isInstalled ? "I" : "-")
                         + (isValid ? "P" : "-")
                         + (hasSubs ? "S" : "-"));
             }
@@ -1118,7 +1118,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                    same named packages in either the set of available
                    elements, or the set of installed elements.  !!!
                    This is O(N * M), should be O(N * lg M). */
-                string version;
+                std::string version;
                 VersionDiff diff = compareVersionAgainstSet(i, otherElems, version);
 
                 char ch;
@@ -1136,7 +1136,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                         attrs["maxComparedVersion"] = version;
                     }
                 } else {
-                    string column = (string) "" + ch + " " + version;
+                    auto column = (std::string) "" + ch + " " + version;
                     if (diff == cvGreater && tty)
                         column = ANSI_RED + column + ANSI_NORMAL;
                     columns.push_back(column);
@@ -1150,7 +1150,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                 columns.push_back(i.querySystem());
 
             if (printDrvPath) {
-                string drvPath = i.queryDrvPath();
+                auto drvPath = i.queryDrvPath();
                 if (xmlOutput) {
                     if (drvPath != "") attrs["drvPath"] = drvPath;
                 } else
@@ -1159,7 +1159,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
 
             if (printOutPath && !xmlOutput) {
                 DrvInfo::Outputs outputs = i.queryOutputs();
-                string s;
+                std::string s;
                 for (auto & j : outputs) {
                     if (!s.empty()) s += ';';
                     if (j.first != "out") { s += j.first; s += "="; }
@@ -1169,7 +1169,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
             }
 
             if (printDescription) {
-                string descr = i.queryMetaString("description");
+                auto descr = i.queryMetaString("description");
                 if (xmlOutput) {
                     if (descr != "") attrs["description"] = descr;
                 } else
@@ -1331,12 +1331,12 @@ static void opDeleteGenerations(Globals & globals, Strings opFlags, Strings opAr
 
     if (opArgs.size() == 1 && opArgs.front() == "old") {
         deleteOldGenerations(globals.profile, globals.dryRun);
-    } else if (opArgs.size() == 1 && opArgs.front().find('d') != string::npos) {
+    } else if (opArgs.size() == 1 && opArgs.front().find('d') != std::string::npos) {
         deleteGenerationsOlderThan(globals.profile, opArgs.front(), globals.dryRun);
-    } else if (opArgs.size() == 1 && opArgs.front().find('+') != string::npos) {
+    } else if (opArgs.size() == 1 && opArgs.front().find('+') != std::string::npos) {
         if (opArgs.front().size() < 2)
             throw Error("invalid number of generations '%1%'", opArgs.front());
-        string str_max = string(opArgs.front(), 1, opArgs.front().size());
+        auto str_max = opArgs.front().substr(1);
         auto max = string2Int<GenerationNumber>(str_max);
         if (!max || *max == 0)
             throw Error("invalid number of generations to keep '%1%'", opArgs.front());
@@ -1366,7 +1366,7 @@ static int main_nix_env(int argc, char * * argv)
         Strings opFlags, opArgs;
         Operation op = 0;
         RepairFlag repair = NoRepair;
-        string file;
+        std::string file;
 
         Globals globals;
 
diff --git a/src/nix-env/user-env.cc b/src/nix-env/user-env.cc
index 5842e6501..37e4086cb 100644
--- a/src/nix-env/user-env.cc
+++ b/src/nix-env/user-env.cc
@@ -32,7 +32,7 @@ DrvInfos queryInstalled(EvalState & state, const Path & userEnv)
 
 bool createUserEnv(EvalState & state, DrvInfos & elems,
     const Path & profile, bool keepDerivations,
-    const string & lockToken)
+    const std::string & lockToken)
 {
     /* Build the components in the user environment, if they don't
        exist already. */
diff --git a/src/nix-env/user-env.hh b/src/nix-env/user-env.hh
index f188efe9b..10646f713 100644
--- a/src/nix-env/user-env.hh
+++ b/src/nix-env/user-env.hh
@@ -8,6 +8,6 @@ DrvInfos queryInstalled(EvalState & state, const Path & userEnv);
 
 bool createUserEnv(EvalState & state, DrvInfos & elems,
     const Path & profile, bool keepDerivations,
-    const string & lockToken);
+    const std::string & lockToken);
 
 }
diff --git a/src/nix-instantiate/nix-instantiate.cc b/src/nix-instantiate/nix-instantiate.cc
index a08683be1..12fc8baf9 100644
--- a/src/nix-instantiate/nix-instantiate.cc
+++ b/src/nix-instantiate/nix-instantiate.cc
@@ -64,7 +64,7 @@ void processExpr(EvalState & state, const Strings & attrPaths,
                 Path drvPath = i.queryDrvPath();
 
                 /* What output do we want? */
-                string outputName = i.queryOutputName();
+                std::string outputName = i.queryOutputName();
                 if (outputName == "")
                     throw Error("derivation '%1%' lacks an 'outputName' attribute ", drvPath);
 
diff --git a/src/nix-store/dotgraph.cc b/src/nix-store/dotgraph.cc
index 8b699f39b..577cadceb 100644
--- a/src/nix-store/dotgraph.cc
+++ b/src/nix-store/dotgraph.cc
@@ -10,37 +10,35 @@ using std::cout;
 namespace nix {
 
 
-static string dotQuote(std::string_view s)
+static std::string dotQuote(std::string_view s)
 {
     return "\"" + std::string(s) + "\"";
 }
 
 
-static string nextColour()
+static const std::string & nextColour()
 {
     static int n = 0;
-    static string colours[] =
+    static std::vector<std::string> colours
         { "black", "red", "green", "blue"
         , "magenta", "burlywood" };
-    return colours[n++ % (sizeof(colours) / sizeof(string))];
+    return colours[n++ % colours.size()];
 }
 
 
-static string makeEdge(const string & src, const string & dst)
+static std::string makeEdge(std::string_view src, std::string_view dst)
 {
-    format f = format("%1% -> %2% [color = %3%];\n")
-        % dotQuote(src) % dotQuote(dst) % dotQuote(nextColour());
-    return f.str();
+    return fmt("%1% -> %2% [color = %3%];\n",
+        dotQuote(src), dotQuote(dst), dotQuote(nextColour()));
 }
 
 
-static string makeNode(const string & id, std::string_view label,
-    const string & colour)
+static std::string makeNode(std::string_view id, std::string_view label,
+    std::string_view colour)
 {
-    format f = format("%1% [label = %2%, shape = box, "
-        "style = filled, fillcolor = %3%];\n")
-        % dotQuote(id) % dotQuote(label) % dotQuote(colour);
-    return f.str();
+    return fmt("%1% [label = %2%, shape = box, "
+        "style = filled, fillcolor = %3%];\n",
+        dotQuote(id), dotQuote(label), dotQuote(colour));
 }
 
 
diff --git a/src/nix-store/graphml.cc b/src/nix-store/graphml.cc
index 8ca5c9c8d..425d61e53 100644
--- a/src/nix-store/graphml.cc
+++ b/src/nix-store/graphml.cc
@@ -19,20 +19,20 @@ static inline std::string_view xmlQuote(std::string_view s)
 }
 
 
-static string symbolicName(const std::string & p)
+static std::string symbolicName(std::string_view p)
 {
-    return string(p, p.find('-') + 1);
+    return std::string(p.substr(0, p.find('-') + 1));
 }
 
 
-static string makeEdge(std::string_view src, std::string_view dst)
+static std::string makeEdge(std::string_view src, std::string_view dst)
 {
     return fmt("  <edge source=\"%1%\" target=\"%2%\"/>\n",
         xmlQuote(src), xmlQuote(dst));
 }
 
 
-static string makeNode(const ValidPathInfo & info)
+static std::string makeNode(const ValidPathInfo & info)
 {
     return fmt(
         "  <node id=\"%1%\">\n"
diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc
index f0ce0368a..ecd7279e9 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@@ -208,8 +208,8 @@ static void opPrintFixedPath(Strings opFlags, Strings opArgs)
 
     Strings::iterator i = opArgs.begin();
     HashType hashAlgo = parseHashType(*i++);
-    string hash = *i++;
-    string name = *i++;
+    std::string hash = *i++;
+    std::string name = *i++;
 
     cout << fmt("%s\n", store->printStorePath(store->makeFixedOutputPath(recursive, Hash::parseAny(hash, hashAlgo), name)));
 }
@@ -238,7 +238,7 @@ static StorePathSet maybeUseOutputs(const StorePath & storePath, bool useOutput,
    graph.  Topological sorting is used to keep the tree relatively
    flat. */
 static void printTree(const StorePath & path,
-    const string & firstPad, const string & tailPad, StorePathSet & done)
+    const std::string & firstPad, const std::string & tailPad, StorePathSet & done)
 {
     if (!done.insert(path).second) {
         cout << fmt("%s%s [...]\n", firstPad, store->printStorePath(path));
@@ -277,7 +277,7 @@ static void opQuery(Strings opFlags, Strings opArgs)
     bool useOutput = false;
     bool includeOutputs = false;
     bool forceRealise = false;
-    string bindingName;
+    std::string bindingName;
 
     for (auto & i : opFlags) {
         QueryType prev = query;
@@ -637,7 +637,7 @@ static void opDump(Strings opFlags, Strings opArgs)
     if (opArgs.size() != 1) throw UsageError("only one argument allowed");
 
     FdSink sink(STDOUT_FILENO);
-    string path = *opArgs.begin();
+    std::string path = *opArgs.begin();
     dumpPath(path, sink);
     sink.flush();
 }
@@ -975,9 +975,9 @@ static void opGenerateBinaryCacheKey(Strings opFlags, Strings opArgs)
 
     if (opArgs.size() != 3) throw UsageError("three arguments expected");
     auto i = opArgs.begin();
-    string keyName = *i++;
-    string secretKeyFile = *i++;
-    string publicKeyFile = *i++;
+    std::string keyName = *i++;
+    std::string secretKeyFile = *i++;
+    std::string publicKeyFile = *i++;
 
     auto secretKey = SecretKey::generate(keyName);
 
diff --git a/src/nix/daemon.cc b/src/nix/daemon.cc
index 6a40a0bd3..940923d3b 100644
--- a/src/nix/daemon.cc
+++ b/src/nix/daemon.cc
@@ -76,7 +76,7 @@ static void setSigChldAction(bool autoReap)
 }
 
 
-bool matchUser(const string & user, const string & group, const Strings & users)
+bool matchUser(const std::string & user, const std::string & group, const Strings & users)
 {
     if (find(users.begin(), users.end(), "*") != users.end())
         return true;
@@ -85,12 +85,12 @@ bool matchUser(const string & user, const string & group, const Strings & users)
         return true;
 
     for (auto & i : users)
-        if (string(i, 0, 1) == "@") {
-            if (group == string(i, 1)) return true;
+        if (i.substr(0, 1) == "@") {
+            if (group == i.substr(1)) return true;
             struct group * gr = getgrnam(i.c_str() + 1);
             if (!gr) continue;
             for (char * * mem = gr->gr_mem; *mem; mem++)
-                if (user == string(*mem)) return true;
+                if (user == std::string(*mem)) return true;
         }
 
     return false;
@@ -198,10 +198,10 @@ static void daemonLoop()
             PeerInfo peer = getPeerInfo(remote.get());
 
             struct passwd * pw = peer.uidKnown ? getpwuid(peer.uid) : 0;
-            string user = pw ? pw->pw_name : std::to_string(peer.uid);
+            std::string user = pw ? pw->pw_name : std::to_string(peer.uid);
 
             struct group * gr = peer.gidKnown ? getgrgid(peer.gid) : 0;
-            string group = gr ? gr->gr_name : std::to_string(peer.gid);
+            std::string group = gr ? gr->gr_name : std::to_string(peer.gid);
 
             Strings trustedUsers = settings.trustedUsers;
             Strings allowedUsers = settings.allowedUsers;
@@ -212,7 +212,7 @@ static void daemonLoop()
             if ((!trusted && !matchUser(user, group, allowedUsers)) || group == settings.buildUsersGroup)
                 throw Error("user '%1%' is not allowed to connect to the Nix daemon", user);
 
-            printInfo(format((string) "accepted connection from pid %1%, user %2%" + (trusted ? " (trusted)" : ""))
+            printInfo(format((std::string) "accepted connection from pid %1%, user %2%" + (trusted ? " (trusted)" : ""))
                 % (peer.pidKnown ? std::to_string(peer.pid) : "<unknown>")
                 % (peer.uidKnown ? user : "<unknown>"));
 
@@ -234,7 +234,7 @@ static void daemonLoop()
 
                 //  For debugging, stuff the pid into argv[1].
                 if (peer.pidKnown && savedArgv[1]) {
-                    string processName = std::to_string(peer.pid);
+                    auto processName = std::to_string(peer.pid);
                     strncpy(savedArgv[1], processName.c_str(), strlen(savedArgv[1]));
                 }
 
diff --git a/src/nix/hash.cc b/src/nix/hash.cc
index 4535e4ab0..60d9593a7 100644
--- a/src/nix/hash.cc
+++ b/src/nix/hash.cc
@@ -177,7 +177,7 @@ static int compatNixHash(int argc, char * * argv)
         else if (*arg == "--base32") base32 = true;
         else if (*arg == "--truncate") truncate = true;
         else if (*arg == "--type") {
-            string s = getArg(*arg, arg, end);
+            std::string s = getArg(*arg, arg, end);
             ht = parseHashType(s);
         }
         else if (*arg == "--to-base16") op = opTo16;
diff --git a/src/nix/prefetch.cc b/src/nix/prefetch.cc
index 094d2a519..f2dd44ba4 100644
--- a/src/nix/prefetch.cc
+++ b/src/nix/prefetch.cc
@@ -16,7 +16,7 @@ using namespace nix;
 
 /* If ‘url’ starts with ‘mirror://’, then resolve it using the list of
    mirrors defined in Nixpkgs. */
-string resolveMirrorUrl(EvalState & state, string url)
+std::string resolveMirrorUrl(EvalState & state, const std::string & url)
 {
     if (url.substr(0, 9) != "mirror://") return url;
 
@@ -38,8 +38,8 @@ string resolveMirrorUrl(EvalState & state, string url)
     if (mirrorList->value->listSize() < 1)
         throw Error("mirror URL '%s' did not expand to anything", url);
 
-    string mirror(state.forceString(*mirrorList->value->listElems()[0]));
-    return mirror + (hasSuffix(mirror, "/") ? "" : "/") + string(s, p + 1);
+    std::string mirror(state.forceString(*mirrorList->value->listElems()[0]));
+    return mirror + (hasSuffix(mirror, "/") ? "" : "/") + s.substr(p + 1);
 }
 
 std::tuple<StorePath, Hash> prefetchFile(
@@ -128,10 +128,10 @@ static int main_nix_prefetch_url(int argc, char * * argv)
 {
     {
         HashType ht = htSHA256;
-        std::vector<string> args;
+        std::vector<std::string> args;
         bool printPath = getEnv("PRINT_PATH") == "1";
         bool fromExpr = false;
-        string attrPath;
+        std::string attrPath;
         bool unpack = false;
         bool executable = false;
         std::optional<std::string> name;
@@ -147,7 +147,7 @@ static int main_nix_prefetch_url(int argc, char * * argv)
             else if (*arg == "--version")
                 printVersion("nix-prefetch-url");
             else if (*arg == "--type") {
-                string s = getArg(*arg, arg, end);
+                auto s = getArg(*arg, arg, end);
                 ht = parseHashType(s);
             }
             else if (*arg == "--print-path")
@@ -186,7 +186,7 @@ static int main_nix_prefetch_url(int argc, char * * argv)
 
         /* If -A is given, get the URL from the specified Nix
            expression. */
-        string url;
+        std::string url;
         if (!fromExpr) {
             if (args.empty())
                 throw UsageError("you must specify a URL");
diff --git a/src/nix/repl.cc b/src/nix/repl.cc
index 575eb0c4c..731337004 100644
--- a/src/nix/repl.cc
+++ b/src/nix/repl.cc
@@ -45,7 +45,7 @@ struct NixRepl
     : gc
     #endif
 {
-    string curDir;
+    std::string curDir;
     std::unique_ptr<EvalState> state;
     Bindings * autoArgs;
 
@@ -62,18 +62,18 @@ struct NixRepl
     NixRepl(const Strings & searchPath, nix::ref<Store> store);
     ~NixRepl();
     void mainLoop(const std::vector<std::string> & files);
-    StringSet completePrefix(string prefix);
-    bool getLine(string & input, const std::string &prompt);
+    StringSet completePrefix(const std::string & prefix);
+    bool getLine(std::string & input, const std::string &prompt);
     StorePath getDerivationPath(Value & v);
-    bool processLine(string line);
+    bool processLine(std::string line);
     void loadFile(const Path & path);
     void loadFlake(const std::string & flakeRef);
     void initEnv();
     void reloadFiles();
     void addAttrsToScope(Value & attrs);
     void addVarToScope(const Symbol & name, Value & v);
-    Expr * parseString(string s);
-    void evalString(string s, Value & v);
+    Expr * parseString(std::string s);
+    void evalString(std::string s, Value & v);
 
     typedef std::set<Value *> ValuesSeen;
     std::ostream &  printValue(std::ostream & str, Value & v, unsigned int maxDepth);
@@ -81,11 +81,11 @@ struct NixRepl
 };
 
 
-string removeWhitespace(string s)
+std::string removeWhitespace(std::string s)
 {
     s = chomp(s);
     size_t n = s.find_first_not_of(" \n\r\t");
-    if (n != string::npos) s = string(s, n);
+    if (n != std::string::npos) s = std::string(s, n);
     return s;
 }
 
@@ -104,7 +104,7 @@ NixRepl::~NixRepl()
     write_history(historyFile.c_str());
 }
 
-string runNix(Path program, const Strings & args,
+std::string runNix(Path program, const Strings & args,
     const std::optional<std::string> & input = {})
 {
     auto subprocessEnv = getEnv();
@@ -198,7 +198,7 @@ namespace {
 
 void NixRepl::mainLoop(const std::vector<std::string> & files)
 {
-    string error = ANSI_RED "error:" ANSI_NORMAL " ";
+    std::string error = ANSI_RED "error:" ANSI_NORMAL " ";
     notice("Welcome to Nix " + nixVersion + ". Type :? for help.\n");
 
     for (auto & i : files)
@@ -252,7 +252,7 @@ void NixRepl::mainLoop(const std::vector<std::string> & files)
 }
 
 
-bool NixRepl::getLine(string & input, const std::string &prompt)
+bool NixRepl::getLine(std::string & input, const std::string & prompt)
 {
     struct sigaction act, old;
     sigset_t savedSignalMask, set;
@@ -297,7 +297,7 @@ bool NixRepl::getLine(string & input, const std::string &prompt)
 }
 
 
-StringSet NixRepl::completePrefix(string prefix)
+StringSet NixRepl::completePrefix(const std::string & prefix)
 {
     StringSet completions;
 
@@ -313,7 +313,7 @@ StringSet NixRepl::completePrefix(string prefix)
 
     size_t slash, dot;
 
-    if ((slash = cur.rfind('/')) != string::npos) {
+    if ((slash = cur.rfind('/')) != std::string::npos) {
         try {
             auto dir = std::string(cur, 0, slash);
             auto prefix2 = std::string(cur, slash + 1);
@@ -323,11 +323,11 @@ StringSet NixRepl::completePrefix(string prefix)
             }
         } catch (Error &) {
         }
-    } else if ((dot = cur.rfind('.')) == string::npos) {
+    } else if ((dot = cur.rfind('.')) == std::string::npos) {
         /* This is a variable name; look it up in the current scope. */
         StringSet::iterator i = varNames.lower_bound(cur);
         while (i != varNames.end()) {
-            if (string(*i, 0, cur.size()) != cur) break;
+            if (i->substr(0, cur.size()) != cur) break;
             completions.insert(prev + *i);
             i++;
         }
@@ -336,8 +336,8 @@ StringSet NixRepl::completePrefix(string prefix)
             /* This is an expression that should evaluate to an
                attribute set.  Evaluate it to get the names of the
                attributes. */
-            string expr(cur, 0, dot);
-            string cur2 = string(cur, dot + 1);
+            auto expr = cur.substr(0, dot);
+            auto cur2 = cur.substr(dot + 1);
 
             Expr * e = parseString(expr);
             Value v;
@@ -345,8 +345,8 @@ StringSet NixRepl::completePrefix(string prefix)
             state->forceAttrs(v, noPos);
 
             for (auto & i : *v.attrs) {
-                string name = i.name;
-                if (string(name, 0, cur2.size()) != cur2) continue;
+                std::string name = i.name;
+                if (name.substr(0, cur2.size()) != cur2) continue;
                 completions.insert(prev + expr + "." + name);
             }
 
@@ -365,7 +365,7 @@ StringSet NixRepl::completePrefix(string prefix)
 }
 
 
-bool isVarName(const string & s)
+static bool isVarName(std::string_view s)
 {
     if (s.size() == 0) return false;
     char c = s[0];
@@ -394,18 +394,18 @@ StorePath NixRepl::getDerivationPath(Value & v) {
 }
 
 
-bool NixRepl::processLine(string line)
+bool NixRepl::processLine(std::string line)
 {
     if (line == "") return true;
 
     _isInterrupted = false;
 
-    string command, arg;
+    std::string command, arg;
 
     if (line[0] == ':') {
         size_t p = line.find_first_of(" \n\r\t");
-        command = string(line, 0, p);
-        if (p != string::npos) arg = removeWhitespace(string(line, p));
+        command = line.substr(0, p);
+        if (p != std::string::npos) arg = removeWhitespace(line.substr(p));
     } else {
         arg = line;
     }
@@ -590,13 +590,13 @@ bool NixRepl::processLine(string line)
 
     else {
         size_t p = line.find('=');
-        string name;
-        if (p != string::npos &&
+        std::string name;
+        if (p != std::string::npos &&
             p < line.size() &&
             line[p + 1] != '=' &&
-            isVarName(name = removeWhitespace(string(line, 0, p))))
+            isVarName(name = removeWhitespace(line.substr(0, p))))
         {
-            Expr * e = parseString(string(line, p + 1));
+            Expr * e = parseString(line.substr(p + 1));
             Value & v(*state->allocValue());
             v.mkThunk(env, e);
             addVarToScope(state->symbols.create(name), v);
@@ -683,7 +683,7 @@ void NixRepl::addAttrsToScope(Value & attrs)
     for (auto & i : *attrs.attrs) {
         staticEnv.vars.emplace_back(i.name, displ);
         env->values[displ++] = i.value;
-        varNames.insert((string) i.name);
+        varNames.insert((std::string) i.name);
     }
     staticEnv.sort();
     staticEnv.deduplicate();
@@ -700,18 +700,18 @@ void NixRepl::addVarToScope(const Symbol & name, Value & v)
     staticEnv.vars.emplace_back(name, displ);
     staticEnv.sort();
     env->values[displ++] = &v;
-    varNames.insert((string) name);
+    varNames.insert((std::string) name);
 }
 
 
-Expr * NixRepl::parseString(string s)
+Expr * NixRepl::parseString(std::string s)
 {
     Expr * e = state->parseExprFromString(std::move(s), curDir, staticEnv);
     return e;
 }
 
 
-void NixRepl::evalString(string s, Value & v)
+void NixRepl::evalString(std::string s, Value & v)
 {
     Expr * e = parseString(s);
     e->eval(*state, *env, v);
@@ -787,7 +787,7 @@ std::ostream & NixRepl::printValue(std::ostream & str, Value & v, unsigned int m
         else if (maxDepth > 0) {
             str << "{ ";
 
-            typedef std::map<string, Value *> Sorted;
+            typedef std::map<std::string, Value *> Sorted;
             Sorted sorted;
             for (auto & i : *v.attrs)
                 sorted[i.name] = i.value;
diff --git a/src/nix/why-depends.cc b/src/nix/why-depends.cc
index 657df30d7..cc05deda0 100644
--- a/src/nix/why-depends.cc
+++ b/src/nix/why-depends.cc
@@ -157,11 +157,11 @@ struct CmdWhyDepends : SourceExprCommand
            closure (i.e., that have a non-infinite distance to
            'dependency'). Print every edge on a path between `package`
            and `dependency`. */
-        std::function<void(Node &, const string &, const string &)> printNode;
+        std::function<void(Node &, const std::string &, const std::string &)> printNode;
 
         struct BailOut { };
 
-        printNode = [&](Node & node, const string & firstPad, const string & tailPad) {
+        printNode = [&](Node & node, const std::string & firstPad, const std::string & tailPad) {
             auto pathS = store->printStorePath(node.path);
 
             assert(node.dist != inf);

From a949673a5b4a08429e9866bc8558e961bb8fe130 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 28 Feb 2022 15:21:03 +0100
Subject: [PATCH 23/52] Fix Darwin build

Fixes #6169
---
 src/libstore/build/local-derivation-goal.cc | 4 ++--
 src/libstore/build/local-derivation-goal.hh | 2 +-
 src/libstore/gc.cc                          | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index 220f80602..a2a52e8f9 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -1933,7 +1933,7 @@ void LocalDerivationGoal::runChild()
                             "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",
                             i.first, i.second.source);
 
-                    string path = i.first;
+                    std::string path = i.first;
                     struct stat st;
                     if (lstat(path.c_str(), &st)) {
                         if (i.second.optional && errno == ENOENT)
@@ -1985,7 +1985,7 @@ void LocalDerivationGoal::runChild()
                 args.push_back("IMPORT_DIR=" + settings.nixDataDir + "/nix/sandbox/");
                 if (allowLocalNetworking) {
                     args.push_back("-D");
-                    args.push_back(string("_ALLOW_LOCAL_NETWORKING=1"));
+                    args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1"));
                 }
                 args.push_back(drv->builder);
             } else {
diff --git a/src/libstore/build/local-derivation-goal.hh b/src/libstore/build/local-derivation-goal.hh
index 2d1222d2f..95692c60d 100644
--- a/src/libstore/build/local-derivation-goal.hh
+++ b/src/libstore/build/local-derivation-goal.hh
@@ -62,7 +62,7 @@ struct LocalDerivationGoal : public DerivationGoal
     Environment env;
 
 #if __APPLE__
-    typedef string SandboxProfile;
+    typedef std::string SandboxProfile;
     SandboxProfile additionalSandboxProfile;
 #endif
 
diff --git a/src/libstore/gc.cc b/src/libstore/gc.cc
index fd38b731c..024da66c1 100644
--- a/src/libstore/gc.cc
+++ b/src/libstore/gc.cc
@@ -413,7 +413,7 @@ void LocalStore::findRuntimeRoots(Roots & roots, bool censor)
         try {
             std::regex lsofRegex(R"(^n(/.*)$)");
             auto lsofLines =
-                tokenizeString<std::vector<string>>(runProgram(LSOF, true, { "-n", "-w", "-F", "n" }), "\n");
+                tokenizeString<std::vector<std::string>>(runProgram(LSOF, true, { "-n", "-w", "-F", "n" }), "\n");
             for (const auto & line : lsofLines) {
                 std::smatch match;
                 if (std::regex_match(line, match, lsofRegex))

From b91500a14e5f1bab33cd9dccbe9a85ad2832062a Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 28 Feb 2022 15:24:24 +0100
Subject: [PATCH 24/52] Fix clang warning

---
 src/libstore/build/local-derivation-goal.cc | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index a2a52e8f9..7e69d4145 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -2383,14 +2383,10 @@ void LocalDerivationGoal::registerOutputs()
             [&](DerivationOutputCAFloating dof) {
                 return newInfoFromCA(dof);
             },
-                [&](DerivationOutputDeferred) {
+            [&](DerivationOutputDeferred) -> ValidPathInfo {
                 // No derivation should reach that point without having been
                 // rewritten first
                 assert(false);
-                // Ugly, but the compiler insists on having this return a value
-                // of type `ValidPathInfo` despite the `assert(false)`, so
-                // let's provide it
-                return *(ValidPathInfo*)0;
             },
         }, output.output);
 

From b8f8aef9d3d026af474a4f7ef8f09678c3e5a7d4 Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Mon, 28 Feb 2022 14:41:09 +0100
Subject: [PATCH 25/52] tests: Fix the start of the daemon
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Make sure that it starts even without the `nix-command` xp feature
- Fail if it doesn’t manage to start

This fixes a 30s wait for every test in `init.sh` as the daemon couldn’t
start, but the code was just waiting 30s and continuing as if everything
was all right.
---
 tests/common.sh.in | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/tests/common.sh.in b/tests/common.sh.in
index 49068f1c3..e485329ba 100644
--- a/tests/common.sh.in
+++ b/tests/common.sh.in
@@ -90,12 +90,18 @@ startDaemon() {
     # Start the daemon, wait for the socket to appear.  !!!
     # ‘nix-daemon’ should have an option to fork into the background.
     rm -f $NIX_DAEMON_SOCKET_PATH
-    PATH=$DAEMON_PATH nix daemon &
+    PATH=$DAEMON_PATH nix-daemon&
+    pidDaemon=$!
     for ((i = 0; i < 300; i++)); do
-        if [[ -S $NIX_DAEMON_SOCKET_PATH ]]; then break; fi
+        if [[ -S $NIX_DAEMON_SOCKET_PATH ]]; then
+          DAEMON_STARTED=1
+          break;
+        fi
         sleep 0.1
     done
-    pidDaemon=$!
+    if [[ -z ${DAEMON_STARTED+x} ]]; then
+      fail "Didn’t manage to start the daemon"
+    fi
     trap "killDaemon" EXIT
     export NIX_REMOTE=daemon
 }

From 158280d8e9b9d7fbf1ccee9cef829081859810e6 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 27 Feb 2022 15:25:22 +0100
Subject: [PATCH 26/52] fetchTree: Do not re-fetch paths already present

---
 src/libexpr/primops/fetchTree.cc | 28 ++++++++++++++++++++++++----
 tests/fetchurl.sh                |  4 ++++
 tests/tarball.sh                 |  4 ++++
 3 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index f3e3e70d8..ea416d2d9 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -185,6 +185,13 @@ static void prim_fetchTree(EvalState & state, const Pos & pos, Value * * args, V
 // FIXME: document
 static RegisterPrimOp primop_fetchTree("fetchTree", 1, prim_fetchTree);
 
+static void setStorePath(EvalState &state, const StorePath &storePath, Value &v) {
+    state.allowPath(storePath);
+
+    auto path = state.store->printStorePath(storePath);
+    v.mkString(path, PathSet({path}));
+}
+
 static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
     const std::string & who, bool unpack, std::string name)
 {
@@ -203,6 +210,8 @@ static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
                 url = state.forceStringNoCtx(*attr.value, *attr.pos);
             else if (n == "sha256")
                 expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, *attr.pos), htSHA256);
+            else if (n == "narHash")
+                expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, *attr.pos), htSHA256);
             else if (n == "name")
                 name = state.forceStringNoCtx(*attr.value, *attr.pos);
             else
@@ -230,6 +239,20 @@ static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
     if (evalSettings.pureEval && !expectedHash)
         throw Error("in pure evaluation mode, '%s' requires a 'sha256' argument", who);
 
+    // early exit if pinned and already in the store
+    if (expectedHash && expectedHash->type == htSHA256) {
+        auto expectedPath =
+            unpack
+            ? state.store->makeFixedOutputPath(FileIngestionMethod::Recursive, *expectedHash, name, {})
+            : state.store->makeFixedOutputPath(FileIngestionMethod::Flat, *expectedHash, name, {});
+
+        auto validPaths = state.store->queryValidPaths({expectedPath}, NoSubstitute);
+        if (!validPaths.empty()) {
+            setStorePath(state, expectedPath, v);
+            return;
+        }
+    }
+
     auto storePath =
         unpack
         ? fetchers::downloadTarball(state.store, *url, name, (bool) expectedHash).first.storePath
@@ -244,10 +267,7 @@ static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
                 *url, expectedHash->to_string(Base32, true), hash.to_string(Base32, true));
     }
 
-    state.allowPath(storePath);
-
-    auto path = state.store->printStorePath(storePath);
-    v.mkString(path, PathSet({path}));
+    setStorePath(state, storePath, v);
 }
 
 static void prim_fetchurl(EvalState & state, const Pos & pos, Value * * args, Value & v)
diff --git a/tests/fetchurl.sh b/tests/fetchurl.sh
index 3d1685f43..b41d8c4b7 100644
--- a/tests/fetchurl.sh
+++ b/tests/fetchurl.sh
@@ -9,6 +9,10 @@ outPath=$(nix-build -vvvvv --expr 'import <nix/fetchurl.nix>' --argstr url file:
 
 cmp $outPath fetchurl.sh
 
+# Do not re-fetch paths already present.
+outPath2=$(nix-build -vvvvv --expr 'import <nix/fetchurl.nix>' --argstr url file:///does-not-exist/must-remain-unused/fetchurl.sh --argstr sha256 $hash --no-out-link)
+test "$outPath" == "$outPath2"
+
 # Now using a base-64 hash.
 clearStore
 
diff --git a/tests/tarball.sh b/tests/tarball.sh
index 1301922a5..d5cab879c 100644
--- a/tests/tarball.sh
+++ b/tests/tarball.sh
@@ -26,10 +26,14 @@ test_tarball() {
     nix-build -o $TEST_ROOT/result '<foo>' -I foo=file://$tarball
 
     nix-build -o $TEST_ROOT/result -E "import (fetchTarball file://$tarball)"
+    # Do not re-fetch paths already present
+    nix-build  -o $TEST_ROOT/result -E "import (fetchTarball { url = file:///does-not-exist/must-remain-unused/$tarball; sha256 = \"$hash\"; })"
 
     nix-build  -o $TEST_ROOT/result -E "import (fetchTree file://$tarball)"
     nix-build  -o $TEST_ROOT/result -E "import (fetchTree { type = \"tarball\"; url = file://$tarball; })"
     nix-build  -o $TEST_ROOT/result -E "import (fetchTree { type = \"tarball\"; url = file://$tarball; narHash = \"$hash\"; })"
+    # Do not re-fetch paths already present
+    nix-build  -o $TEST_ROOT/result -E "import (fetchTree { type = \"tarball\"; url = file:///does-not-exist/must-remain-unused/$tarball; narHash = \"$hash\"; })"
     nix-build  -o $TEST_ROOT/result -E "import (fetchTree { type = \"tarball\"; url = file://$tarball; narHash = \"sha256-xdKv2pq/IiwLSnBBJXW8hNowI4MrdZfW+SYqDQs7Tzc=\"; })" 2>&1 | grep 'NAR hash mismatch in input'
 
     nix-instantiate --strict --eval -E "!((import (fetchTree { type = \"tarball\"; url = file://$tarball; narHash = \"$hash\"; })) ? submodules)" >&2

From ee019d0afce63f5145a043b025a37dfc39444a3d Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 27 Feb 2022 15:59:34 +0100
Subject: [PATCH 27/52] Add EvalState::allowAndSetStorePathString helper

This switches addPath from `printStorePath` to `toRealPath`.
---
 src/libexpr/eval.cc              |  8 ++++++++
 src/libexpr/eval.hh              |  3 +++
 src/libexpr/primops.cc           | 15 +++++----------
 src/libexpr/primops/fetchTree.cc | 11 ++---------
 4 files changed, 18 insertions(+), 19 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 60f0bf08c..d94afbb99 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -517,6 +517,14 @@ void EvalState::allowPath(const StorePath & storePath)
         allowedPaths->insert(store->toRealPath(storePath));
 }
 
+void EvalState::allowAndSetStorePathString(const StorePath &storePath, Value &v)
+{
+    allowPath(storePath);
+
+    auto path = store->printStorePath(storePath);
+    v.mkString(path, PathSet({path}));
+}
+
 Path EvalState::checkSourcePath(const Path & path_)
 {
     if (!allowedPaths) return path_;
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 1f0e97b2e..9324961f7 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -161,6 +161,9 @@ public:
        the real store path if `store` is a chroot store. */
     void allowPath(const StorePath & storePath);
 
+    /* Allow access to a store path and return it as a string. */
+    void allowAndSetStorePathString(const StorePath & storePath, Value &v);
+
     /* Check whether access to a path is allowed and throw an error if
        not. Otherwise return the canonicalised path. */
     Path checkSourcePath(const Path & path);
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index aa22c3b61..3124025aa 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1919,20 +1919,15 @@ static void addPath(
         if (expectedHash)
             expectedStorePath = state.store->makeFixedOutputPath(method, *expectedHash, name);
 
-        Path dstPath;
         if (!expectedHash || !state.store->isValidPath(*expectedStorePath)) {
-            dstPath = state.store->printStorePath(settings.readOnlyMode
+            StorePath dstPath = settings.readOnlyMode
                 ? state.store->computeStorePathForPath(name, path, method, htSHA256, filter).first
-                : state.store->addToStore(name, path, method, htSHA256, filter, state.repair, refs));
-            if (expectedHash && expectedStorePath != state.store->parseStorePath(dstPath))
+                : state.store->addToStore(name, path, method, htSHA256, filter, state.repair, refs);
+            if (expectedHash && expectedStorePath != dstPath)
                 throw Error("store path mismatch in (possibly filtered) path added from '%s'", path);
+            state.allowAndSetStorePathString(dstPath, v);
         } else
-            dstPath = state.store->printStorePath(*expectedStorePath);
-
-        v.mkString(dstPath, {dstPath});
-
-        state.allowPath(dstPath);
-
+            state.allowAndSetStorePathString(*expectedStorePath, v);
     } catch (Error & e) {
         e.addTrace(pos, "while adding path '%s'", path);
         throw;
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index ea416d2d9..2eeee7173 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -185,13 +185,6 @@ static void prim_fetchTree(EvalState & state, const Pos & pos, Value * * args, V
 // FIXME: document
 static RegisterPrimOp primop_fetchTree("fetchTree", 1, prim_fetchTree);
 
-static void setStorePath(EvalState &state, const StorePath &storePath, Value &v) {
-    state.allowPath(storePath);
-
-    auto path = state.store->printStorePath(storePath);
-    v.mkString(path, PathSet({path}));
-}
-
 static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
     const std::string & who, bool unpack, std::string name)
 {
@@ -248,7 +241,7 @@ static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
 
         auto validPaths = state.store->queryValidPaths({expectedPath}, NoSubstitute);
         if (!validPaths.empty()) {
-            setStorePath(state, expectedPath, v);
+            state.allowAndSetStorePathString(expectedPath, v);
             return;
         }
     }
@@ -267,7 +260,7 @@ static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
                 *url, expectedHash->to_string(Base32, true), hash.to_string(Base32, true));
     }
 
-    setStorePath(state, storePath, v);
+    state.allowAndSetStorePathString(storePath, v);
 }
 
 static void prim_fetchurl(EvalState & state, const Pos & pos, Value * * args, Value & v)

From ea71da395fe23fc0b4adb6fe5075742441e8baf8 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 1 Mar 2022 01:29:34 +0000
Subject: [PATCH 28/52] Move some stuff from `Settings` to a new
 `FetchSettings`.

Starting work on #5638

The exact boundary between `FetchSettings` and `EvalSettings` is not
clear to me, but that's fine. First lets clean out `libstore`, and then
worry about what, if anything, should be the separation between those
two.
---
 src/libexpr/flake/config.cc       |  3 +-
 src/libexpr/flake/flake.cc        |  9 +--
 src/libfetchers/fetch-settings.cc | 13 +++++
 src/libfetchers/fetch-settings.hh | 93 +++++++++++++++++++++++++++++++
 src/libfetchers/git.cc            |  6 +-
 src/libfetchers/github.cc         |  6 +-
 src/libfetchers/mercurial.cc      |  6 +-
 src/libfetchers/registry.cc       |  4 +-
 src/libstore/globals.hh           | 71 -----------------------
 9 files changed, 128 insertions(+), 83 deletions(-)
 create mode 100644 src/libfetchers/fetch-settings.cc
 create mode 100644 src/libfetchers/fetch-settings.hh

diff --git a/src/libexpr/flake/config.cc b/src/libexpr/flake/config.cc
index 7ecd61816..a811e59a1 100644
--- a/src/libexpr/flake/config.cc
+++ b/src/libexpr/flake/config.cc
@@ -1,5 +1,6 @@
 #include "flake.hh"
 #include "globals.hh"
+#include "fetch-settings.hh"
 
 #include <nlohmann/json.hpp>
 
@@ -53,7 +54,7 @@ void ConfigFile::apply()
             auto trustedList = readTrustedList();
 
             bool trusted = false;
-            if (nix::settings.acceptFlakeConfig){
+            if (nix::fetchSettings.acceptFlakeConfig){
                 trusted = true;
             } else if (auto saved = get(get(trustedList, name).value_or(std::map<std::string, bool>()), valueS)) {
                 trusted = *saved;
diff --git a/src/libexpr/flake/flake.cc b/src/libexpr/flake/flake.cc
index ad0881641..6a1aca40d 100644
--- a/src/libexpr/flake/flake.cc
+++ b/src/libexpr/flake/flake.cc
@@ -6,6 +6,7 @@
 #include "store-api.hh"
 #include "fetchers.hh"
 #include "finally.hh"
+#include "fetch-settings.hh"
 
 namespace nix {
 
@@ -315,7 +316,7 @@ LockedFlake lockFlake(
 
     FlakeCache flakeCache;
 
-    auto useRegistries = lockFlags.useRegistries.value_or(settings.useRegistries);
+    auto useRegistries = lockFlags.useRegistries.value_or(fetchSettings.useRegistries);
 
     auto flake = getFlake(state, topRef, useRegistries, flakeCache);
 
@@ -591,7 +592,7 @@ LockedFlake lockFlake(
             if (lockFlags.writeLockFile) {
                 if (auto sourcePath = topRef.input.getSourcePath()) {
                     if (!newLockFile.isImmutable()) {
-                        if (settings.warnDirty)
+                        if (fetchSettings.warnDirty)
                             warn("will not write lock file of flake '%s' because it has a mutable input", topRef);
                     } else {
                         if (!lockFlags.updateLockFile)
@@ -618,7 +619,7 @@ LockedFlake lockFlake(
                         if (lockFlags.commitLockFile) {
                             std::string cm;
 
-                            cm = settings.commitLockFileSummary.get();
+                            cm = fetchSettings.commitLockFileSummary.get();
 
                             if (cm == "") {
                                 cm = fmt("%s: %s", relPath, lockFileExists ? "Update" : "Add");
@@ -716,7 +717,7 @@ static void prim_getFlake(EvalState & state, const Pos & pos, Value * * args, Va
         lockFlake(state, flakeRef,
             LockFlags {
                 .updateLockFile = false,
-                .useRegistries = !evalSettings.pureEval && settings.useRegistries,
+                .useRegistries = !evalSettings.pureEval && fetchSettings.useRegistries,
                 .allowMutable  = !evalSettings.pureEval,
             }),
         v);
diff --git a/src/libfetchers/fetch-settings.cc b/src/libfetchers/fetch-settings.cc
new file mode 100644
index 000000000..e7d5244dc
--- /dev/null
+++ b/src/libfetchers/fetch-settings.cc
@@ -0,0 +1,13 @@
+#include "fetch-settings.hh"
+
+namespace nix {
+
+FetchSettings::FetchSettings()
+{
+}
+
+FetchSettings fetchSettings;
+
+static GlobalConfig::Register rFetchSettings(&fetchSettings);
+
+}
diff --git a/src/libfetchers/fetch-settings.hh b/src/libfetchers/fetch-settings.hh
new file mode 100644
index 000000000..58a2aded3
--- /dev/null
+++ b/src/libfetchers/fetch-settings.hh
@@ -0,0 +1,93 @@
+#pragma once
+
+#include "types.hh"
+#include "config.hh"
+#include "util.hh"
+
+#include <map>
+#include <limits>
+
+#include <sys/types.h>
+
+namespace nix {
+
+struct FetchSettings : public Config
+{
+    FetchSettings();
+
+    Setting<StringMap> accessTokens{this, {}, "access-tokens",
+        R"(
+          Access tokens used to access protected GitHub, GitLab, or
+          other locations requiring token-based authentication.
+
+          Access tokens are specified as a string made up of
+          space-separated `host=token` values.  The specific token
+          used is selected by matching the `host` portion against the
+          "host" specification of the input. The actual use of the
+          `token` value is determined by the type of resource being
+          accessed:
+
+          * Github: the token value is the OAUTH-TOKEN string obtained
+            as the Personal Access Token from the Github server (see
+            https://docs.github.com/en/developers/apps/authorizing-oath-apps).
+
+          * Gitlab: the token value is either the OAuth2 token or the
+            Personal Access Token (these are different types tokens
+            for gitlab, see
+            https://docs.gitlab.com/12.10/ee/api/README.html#authentication).
+            The `token` value should be `type:tokenstring` where
+            `type` is either `OAuth2` or `PAT` to indicate which type
+            of token is being specified.
+
+          Example `~/.config/nix/nix.conf`:
+
+          ```
+          access-tokens = github.com=23ac...b289 gitlab.mycompany.com=PAT:A123Bp_Cd..EfG gitlab.com=OAuth2:1jklw3jk
+          ```
+
+          Example `~/code/flake.nix`:
+
+          ```nix
+          input.foo = {
+            type = "gitlab";
+            host = "gitlab.mycompany.com";
+            owner = "mycompany";
+            repo = "pro";
+          };
+          ```
+
+          This example specifies three tokens, one each for accessing
+          github.com, gitlab.mycompany.com, and sourceforge.net.
+
+          The `input.foo` uses the "gitlab" fetcher, which might
+          requires specifying the token type along with the token
+          value.
+          )"};
+
+    Setting<bool> allowDirty{this, true, "allow-dirty",
+        "Whether to allow dirty Git/Mercurial trees."};
+
+    Setting<bool> warnDirty{this, true, "warn-dirty",
+        "Whether to warn about dirty Git/Mercurial trees."};
+
+    Setting<std::string> flakeRegistry{this, "https://github.com/NixOS/flake-registry/raw/master/flake-registry.json", "flake-registry",
+        "Path or URI of the global flake registry."};
+
+    Setting<bool> useRegistries{this, true, "use-registries",
+        "Whether to use flake registries to resolve flake references."};
+
+    Setting<bool> acceptFlakeConfig{this, false, "accept-flake-config",
+        "Whether to accept nix configuration from a flake without prompting."};
+
+    Setting<std::string> commitLockFileSummary{
+        this, "", "commit-lockfile-summary",
+        R"(
+          The commit summary to use when committing changed flake lock files. If
+          empty, the summary is generated based on the action performed.
+        )"};
+};
+
+// FIXME: don't use a global variable.
+extern FetchSettings fetchSettings;
+
+}
diff --git a/src/libfetchers/git.cc b/src/libfetchers/git.cc
index 7f65c1533..c0beca2f2 100644
--- a/src/libfetchers/git.cc
+++ b/src/libfetchers/git.cc
@@ -6,6 +6,8 @@
 #include "url-parts.hh"
 #include "pathlocks.hh"
 
+#include "fetch-settings.hh"
+
 #include <sys/time.h>
 #include <sys/wait.h>
 
@@ -246,10 +248,10 @@ struct GitInputScheme : InputScheme
 
                 /* This is an unclean working tree. So copy all tracked files. */
 
-                if (!settings.allowDirty)
+                if (!fetchSettings.allowDirty)
                     throw Error("Git tree '%s' is dirty", actualUrl);
 
-                if (settings.warnDirty)
+                if (fetchSettings.warnDirty)
                     warn("Git tree '%s' is dirty", actualUrl);
 
                 auto gitOpts = Strings({ "-C", actualUrl, "ls-files", "-z" });
diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index 70622bf79..a1430f087 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -1,11 +1,13 @@
 #include "filetransfer.hh"
 #include "cache.hh"
-#include "fetchers.hh"
 #include "globals.hh"
 #include "store-api.hh"
 #include "types.hh"
 #include "url-parts.hh"
 
+#include "fetchers.hh"
+#include "fetch-settings.hh"
+
 #include <optional>
 #include <nlohmann/json.hpp>
 #include <fstream>
@@ -157,7 +159,7 @@ struct GitArchiveInputScheme : InputScheme
 
     std::optional<std::string> getAccessToken(const std::string & host) const
     {
-        auto tokens = settings.accessTokens.get();
+        auto tokens = fetchSettings.accessTokens.get();
         if (auto token = get(tokens, host))
             return *token;
         return {};
diff --git a/src/libfetchers/mercurial.cc b/src/libfetchers/mercurial.cc
index 12cdecbc1..8b82e9daa 100644
--- a/src/libfetchers/mercurial.cc
+++ b/src/libfetchers/mercurial.cc
@@ -5,6 +5,8 @@
 #include "store-api.hh"
 #include "url-parts.hh"
 
+#include "fetch-settings.hh"
+
 #include <sys/time.h>
 
 using namespace std::string_literals;
@@ -165,10 +167,10 @@ struct MercurialInputScheme : InputScheme
                 /* This is an unclean working tree. So copy all tracked
                    files. */
 
-                if (!settings.allowDirty)
+                if (!fetchSettings.allowDirty)
                     throw Error("Mercurial tree '%s' is unclean", actualUrl);
 
-                if (settings.warnDirty)
+                if (fetchSettings.warnDirty)
                     warn("Mercurial tree '%s' is unclean", actualUrl);
 
                 input.attrs.insert_or_assign("ref", chomp(runHg({ "branch", "-R", actualUrl })));
diff --git a/src/libfetchers/registry.cc b/src/libfetchers/registry.cc
index f35359d4b..acd1ff866 100644
--- a/src/libfetchers/registry.cc
+++ b/src/libfetchers/registry.cc
@@ -5,6 +5,8 @@
 #include "store-api.hh"
 #include "local-fs-store.hh"
 
+#include "fetch-settings.hh"
+
 #include <nlohmann/json.hpp>
 
 namespace nix::fetchers {
@@ -150,7 +152,7 @@ void overrideRegistry(
 static std::shared_ptr<Registry> getGlobalRegistry(ref<Store> store)
 {
     static auto reg = [&]() {
-        auto path = settings.flakeRegistry.get();
+        auto path = fetchSettings.flakeRegistry.get();
 
         if (!hasPrefix(path, "/")) {
             auto storePath = downloadFile(store, path, "flake-registry.json", false).storePath;
diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index b31a2e8dc..feb6899cd 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -880,55 +880,6 @@ public:
           are loaded as plugins (non-recursively).
         )"};
 
-    Setting<StringMap> accessTokens{this, {}, "access-tokens",
-        R"(
-          Access tokens used to access protected GitHub, GitLab, or
-          other locations requiring token-based authentication.
-
-          Access tokens are specified as a string made up of
-          space-separated `host=token` values.  The specific token
-          used is selected by matching the `host` portion against the
-          "host" specification of the input. The actual use of the
-          `token` value is determined by the type of resource being
-          accessed:
-
-          * Github: the token value is the OAUTH-TOKEN string obtained
-            as the Personal Access Token from the Github server (see
-            https://docs.github.com/en/developers/apps/authorizing-oath-apps).
-
-          * Gitlab: the token value is either the OAuth2 token or the
-            Personal Access Token (these are different types tokens
-            for gitlab, see
-            https://docs.gitlab.com/12.10/ee/api/README.html#authentication).
-            The `token` value should be `type:tokenstring` where
-            `type` is either `OAuth2` or `PAT` to indicate which type
-            of token is being specified.
-
-          Example `~/.config/nix/nix.conf`:
-
-          ```
-          access-tokens = github.com=23ac...b289 gitlab.mycompany.com=PAT:A123Bp_Cd..EfG gitlab.com=OAuth2:1jklw3jk
-          ```
-
-          Example `~/code/flake.nix`:
-
-          ```nix
-          input.foo = {
-            type = "gitlab";
-            host = "gitlab.mycompany.com";
-            owner = "mycompany";
-            repo = "pro";
-          };
-          ```
-
-          This example specifies three tokens, one each for accessing
-          github.com, gitlab.mycompany.com, and sourceforge.net.
-
-          The `input.foo` uses the "gitlab" fetcher, which might
-          requires specifying the token type along with the token
-          value.
-          )"};
-
     Setting<std::set<ExperimentalFeature>> experimentalFeatures{this, {}, "experimental-features",
         "Experimental Nix features to enable."};
 
@@ -936,18 +887,9 @@ public:
 
     void requireExperimentalFeature(const ExperimentalFeature &);
 
-    Setting<bool> allowDirty{this, true, "allow-dirty",
-        "Whether to allow dirty Git/Mercurial trees."};
-
-    Setting<bool> warnDirty{this, true, "warn-dirty",
-        "Whether to warn about dirty Git/Mercurial trees."};
-
     Setting<size_t> narBufferSize{this, 32 * 1024 * 1024, "nar-buffer-size",
         "Maximum size of NARs before spilling them to disk."};
 
-    Setting<std::string> flakeRegistry{this, "https://github.com/NixOS/flake-registry/raw/master/flake-registry.json", "flake-registry",
-        "Path or URI of the global flake registry."};
-
     Setting<bool> allowSymlinkedStore{
         this, false, "allow-symlinked-store",
         R"(
@@ -960,19 +902,6 @@ public:
           resolves to a different location from that of the build machine. You
           can enable this setting if you are sure you're not going to do that.
         )"};
-
-    Setting<bool> useRegistries{this, true, "use-registries",
-        "Whether to use flake registries to resolve flake references."};
-
-    Setting<bool> acceptFlakeConfig{this, false, "accept-flake-config",
-        "Whether to accept nix configuration from a flake without prompting."};
-
-    Setting<std::string> commitLockFileSummary{
-        this, "", "commit-lockfile-summary",
-        R"(
-          The commit summary to use when committing changed flake lock files. If
-          empty, the summary is generated based on the action performed.
-        )"};
 };
 
 

From d974d2ad59d1cc8aee63e2a18124e58c1084ff65 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 1 Mar 2022 11:29:19 +0100
Subject: [PATCH 29/52] fetch{url,Tarball}: Remove 'narHash' attribute

This was introduced in #6174. However fetch{url,Tarball} are legacy
and we shouldn't have an undocumented attribute that does the same
thing as one that already exists ('sha256').
---
 src/libexpr/eval.cc              | 2 +-
 src/libexpr/eval.hh              | 2 +-
 src/libexpr/primops/fetchTree.cc | 2 --
 3 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index d94afbb99..8c5888497 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -517,7 +517,7 @@ void EvalState::allowPath(const StorePath & storePath)
         allowedPaths->insert(store->toRealPath(storePath));
 }
 
-void EvalState::allowAndSetStorePathString(const StorePath &storePath, Value &v)
+void EvalState::allowAndSetStorePathString(const StorePath &storePath, Value & v)
 {
     allowPath(storePath);
 
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 9324961f7..36a53729a 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -162,7 +162,7 @@ public:
     void allowPath(const StorePath & storePath);
 
     /* Allow access to a store path and return it as a string. */
-    void allowAndSetStorePathString(const StorePath & storePath, Value &v);
+    void allowAndSetStorePathString(const StorePath & storePath, Value & v);
 
     /* Check whether access to a path is allowed and throw an error if
        not. Otherwise return the canonicalised path. */
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index 2eeee7173..cb929b99a 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -203,8 +203,6 @@ static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
                 url = state.forceStringNoCtx(*attr.value, *attr.pos);
             else if (n == "sha256")
                 expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, *attr.pos), htSHA256);
-            else if (n == "narHash")
-                expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, *attr.pos), htSHA256);
             else if (n == "name")
                 name = state.forceStringNoCtx(*attr.value, *attr.pos);
             else

From b6deca7c0dcf6e5f0da1d186dc1a1288325e1d88 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 1 Mar 2022 12:11:10 +0100
Subject: [PATCH 30/52] fetchTree: Use isValidPath, add comment

---
 src/libexpr/primops/fetchTree.cc | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index 2eeee7173..892c59fba 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -239,13 +239,14 @@ static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
             ? state.store->makeFixedOutputPath(FileIngestionMethod::Recursive, *expectedHash, name, {})
             : state.store->makeFixedOutputPath(FileIngestionMethod::Flat, *expectedHash, name, {});
 
-        auto validPaths = state.store->queryValidPaths({expectedPath}, NoSubstitute);
-        if (!validPaths.empty()) {
+        if (state.store->isValidPath(expectedPath)) {
             state.allowAndSetStorePathString(expectedPath, v);
             return;
         }
     }
 
+    // TODO: fetching may fail, yet the path may be substitutable.
+    //       https://github.com/NixOS/nix/issues/4313
     auto storePath =
         unpack
         ? fetchers::downloadTarball(state.store, *url, name, (bool) expectedHash).first.storePath

From c511134a94d1ff85251da155b6773574bcff53fe Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Tue, 1 Mar 2022 14:59:12 +0100
Subject: [PATCH 31/52] Acknowledge that the macOS tests are flaky

Restart the tests (at most once) on `unexpected EOF` errors.

This is truly ugly, but might prevent half of the CI runs to fail
because of https://github.com/NixOS/nix/issues/3605
---
 mk/run_test.sh | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/mk/run_test.sh b/mk/run_test.sh
index 3783d3bf7..b876859f8 100755
--- a/mk/run_test.sh
+++ b/mk/run_test.sh
@@ -14,9 +14,27 @@ if [ -t 1 ]; then
     yellow=""
     normal=""
 fi
-(cd tests && env ${TESTS_ENVIRONMENT} init.sh 2>/dev/null > /dev/null)
-log="$(cd $(dirname $1) && env ${TESTS_ENVIRONMENT} $(basename $1) 2>&1)"
-status=$?
+
+run_test () {
+    (cd tests && env ${TESTS_ENVIRONMENT} init.sh 2>/dev/null > /dev/null)
+    log="$(cd $(dirname $1) && env ${TESTS_ENVIRONMENT} $(basename $1) 2>&1)"
+    status=$?
+}
+
+run_test "$1"
+
+# Hack: Retry the test if it fails with “unexpected EOF reading a line” as these
+# appear randomly without anyone knowing why.
+# See https://github.com/NixOS/nix/issues/3605 for more info
+if [[ $status -ne 0 && $status -ne 99 && \
+    "$(uname)" == "Darwin" && \
+    "$log" =~ "unexpected EOF reading a line"
+]]; then
+    echo "$post_run_msg [${yellow}FAIL$normal] (possibly flaky, so will be retried)"
+    echo "$log" | sed 's/^/    /'
+    run_test "$1"
+fi
+
 if [ $status -eq 0 ]; then
   echo "$post_run_msg [${green}PASS$normal]"
 elif [ $status -eq 99 ]; then

From f4d57aa4907515802301dc6e540abc08809d311c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= <bjorn.forsman@gmail.com>
Date: Thu, 10 Dec 2020 12:16:22 +0100
Subject: [PATCH 32/52] installer: allow overriding nix user GID and UIDs

Needed to resolve conflict in case the default GID and UIDs are in use.
---
 scripts/install-multi-user.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/install-multi-user.sh b/scripts/install-multi-user.sh
index d3ed53d09..5f2c93b7f 100644
--- a/scripts/install-multi-user.sh
+++ b/scripts/install-multi-user.sh
@@ -23,10 +23,10 @@ readonly RED='\033[31m'
 # installer allows overriding build user count to speed up installation
 # as creating each user takes non-trivial amount of time on macos
 readonly NIX_USER_COUNT=${NIX_USER_COUNT:-32}
-readonly NIX_BUILD_GROUP_ID="30000"
+readonly NIX_BUILD_GROUP_ID="${NIX_BUILD_GROUP_ID:-30000}"
 readonly NIX_BUILD_GROUP_NAME="nixbld"
 # darwin installer needs to override these
-NIX_FIRST_BUILD_UID="30001"
+NIX_FIRST_BUILD_UID="${NIX_FIRST_BUILD_UID:-30001}"
 NIX_BUILD_USER_NAME_TEMPLATE="nixbld%d"
 # Please don't change this. We don't support it, because the
 # default shell profile that comes with Nix doesn't support it.

From e862833ec662c1bffbe31b9a229147de391e801a Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 1 Mar 2022 19:43:07 +0000
Subject: [PATCH 33/52] Move `BuildResult` defintion to its own header

Just like we did for `ValidPathInfo` in
d92d4f85a5c8a2a2385c084500a8b6bd54b54e6c.
---
 src/build-remote/build-remote.cc      |  1 +
 src/libstore/build-result.hh          | 77 +++++++++++++++++++++++++++
 src/libstore/build/derivation-goal.hh |  1 +
 src/libstore/daemon.cc                |  1 +
 src/libstore/legacy-ssh-store.cc      |  1 +
 src/libstore/remote-store.cc          |  1 +
 src/libstore/store-api.hh             | 66 +----------------------
 src/nix-store/nix-store.cc            |  1 +
 8 files changed, 84 insertions(+), 65 deletions(-)
 create mode 100644 src/libstore/build-result.hh

diff --git a/src/build-remote/build-remote.cc b/src/build-remote/build-remote.cc
index 9d2eacb54..8c9133c17 100644
--- a/src/build-remote/build-remote.cc
+++ b/src/build-remote/build-remote.cc
@@ -14,6 +14,7 @@
 #include "pathlocks.hh"
 #include "globals.hh"
 #include "serialise.hh"
+#include "build-result.hh"
 #include "store-api.hh"
 #include "derivations.hh"
 #include "local-store.hh"
diff --git a/src/libstore/build-result.hh b/src/libstore/build-result.hh
new file mode 100644
index 000000000..018ba31b3
--- /dev/null
+++ b/src/libstore/build-result.hh
@@ -0,0 +1,77 @@
+#pragma once
+
+#include "realisation.hh"
+
+#include <string>
+#include <chrono>
+
+
+namespace nix {
+
+struct BuildResult
+{
+    /* Note: don't remove status codes, and only add new status codes
+       at the end of the list, to prevent client/server
+       incompatibilities in the nix-store --serve protocol. */
+    enum Status {
+        Built = 0,
+        Substituted,
+        AlreadyValid,
+        PermanentFailure,
+        InputRejected,
+        OutputRejected,
+        TransientFailure, // possibly transient
+        CachedFailure, // no longer used
+        TimedOut,
+        MiscFailure,
+        DependencyFailed,
+        LogLimitExceeded,
+        NotDeterministic,
+        ResolvesToAlreadyValid,
+    } status = MiscFailure;
+    std::string errorMsg;
+
+    std::string toString() const {
+        auto strStatus = [&]() {
+            switch (status) {
+                case Built: return "Built";
+                case Substituted: return "Substituted";
+                case AlreadyValid: return "AlreadyValid";
+                case PermanentFailure: return "PermanentFailure";
+                case InputRejected: return "InputRejected";
+                case OutputRejected: return "OutputRejected";
+                case TransientFailure: return "TransientFailure";
+                case CachedFailure: return "CachedFailure";
+                case TimedOut: return "TimedOut";
+                case MiscFailure: return "MiscFailure";
+                case DependencyFailed: return "DependencyFailed";
+                case LogLimitExceeded: return "LogLimitExceeded";
+                case NotDeterministic: return "NotDeterministic";
+                case ResolvesToAlreadyValid: return "ResolvesToAlreadyValid";
+                default: return "Unknown";
+            };
+        }();
+        return strStatus + ((errorMsg == "") ? "" : " : " + errorMsg);
+    }
+
+    /* How many times this build was performed. */
+    unsigned int timesBuilt = 0;
+
+    /* If timesBuilt > 1, whether some builds did not produce the same
+       result. (Note that 'isNonDeterministic = false' does not mean
+       the build is deterministic, just that we don't have evidence of
+       non-determinism.) */
+    bool isNonDeterministic = false;
+
+    DrvOutputs builtOutputs;
+
+    /* The start/stop times of the build (or one of the rounds, if it
+       was repeated). */
+    time_t startTime = 0, stopTime = 0;
+
+    bool success() {
+        return status == Built || status == Substituted || status == AlreadyValid || status == ResolvesToAlreadyValid;
+    }
+};
+
+}
diff --git a/src/libstore/build/derivation-goal.hh b/src/libstore/build/derivation-goal.hh
index d947482ef..6f158bdbf 100644
--- a/src/libstore/build/derivation-goal.hh
+++ b/src/libstore/build/derivation-goal.hh
@@ -2,6 +2,7 @@
 
 #include "parsed-derivations.hh"
 #include "lock.hh"
+#include "build-result.hh"
 #include "store-api.hh"
 #include "pathlocks.hh"
 #include "goal.hh"
diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index 2ba03f0dd..9d4f6b4a4 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -1,6 +1,7 @@
 #include "daemon.hh"
 #include "monitor-fd.hh"
 #include "worker-protocol.hh"
+#include "build-result.hh"
 #include "store-api.hh"
 #include "path-with-outputs.hh"
 #include "finally.hh"
diff --git a/src/libstore/legacy-ssh-store.cc b/src/libstore/legacy-ssh-store.cc
index 6b3daae7f..16c2b90c6 100644
--- a/src/libstore/legacy-ssh-store.cc
+++ b/src/libstore/legacy-ssh-store.cc
@@ -2,6 +2,7 @@
 #include "pool.hh"
 #include "remote-store.hh"
 #include "serve-protocol.hh"
+#include "build-result.hh"
 #include "store-api.hh"
 #include "path-with-outputs.hh"
 #include "worker-protocol.hh"
diff --git a/src/libstore/remote-store.cc b/src/libstore/remote-store.cc
index e7ffa6595..cbcb75c00 100644
--- a/src/libstore/remote-store.cc
+++ b/src/libstore/remote-store.cc
@@ -2,6 +2,7 @@
 #include "util.hh"
 #include "path-with-outputs.hh"
 #include "remote-fs-accessor.hh"
+#include "build-result.hh"
 #include "remote-store.hh"
 #include "worker-protocol.hh"
 #include "archive.hh"
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index e4fb1f1fd..8c57596d0 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -131,72 +131,8 @@ struct GCResults
 
 enum BuildMode { bmNormal, bmRepair, bmCheck };
 
+struct BuildResult;
 
-struct BuildResult
-{
-    /* Note: don't remove status codes, and only add new status codes
-       at the end of the list, to prevent client/server
-       incompatibilities in the nix-store --serve protocol. */
-    enum Status {
-        Built = 0,
-        Substituted,
-        AlreadyValid,
-        PermanentFailure,
-        InputRejected,
-        OutputRejected,
-        TransientFailure, // possibly transient
-        CachedFailure, // no longer used
-        TimedOut,
-        MiscFailure,
-        DependencyFailed,
-        LogLimitExceeded,
-        NotDeterministic,
-        ResolvesToAlreadyValid,
-    } status = MiscFailure;
-    std::string errorMsg;
-
-    std::string toString() const {
-        auto strStatus = [&]() {
-            switch (status) {
-                case Built: return "Built";
-                case Substituted: return "Substituted";
-                case AlreadyValid: return "AlreadyValid";
-                case PermanentFailure: return "PermanentFailure";
-                case InputRejected: return "InputRejected";
-                case OutputRejected: return "OutputRejected";
-                case TransientFailure: return "TransientFailure";
-                case CachedFailure: return "CachedFailure";
-                case TimedOut: return "TimedOut";
-                case MiscFailure: return "MiscFailure";
-                case DependencyFailed: return "DependencyFailed";
-                case LogLimitExceeded: return "LogLimitExceeded";
-                case NotDeterministic: return "NotDeterministic";
-                case ResolvesToAlreadyValid: return "ResolvesToAlreadyValid";
-                default: return "Unknown";
-            };
-        }();
-        return strStatus + ((errorMsg == "") ? "" : " : " + errorMsg);
-    }
-
-    /* How many times this build was performed. */
-    unsigned int timesBuilt = 0;
-
-    /* If timesBuilt > 1, whether some builds did not produce the same
-       result. (Note that 'isNonDeterministic = false' does not mean
-       the build is deterministic, just that we don't have evidence of
-       non-determinism.) */
-    bool isNonDeterministic = false;
-
-    DrvOutputs builtOutputs;
-
-    /* The start/stop times of the build (or one of the rounds, if it
-       was repeated). */
-    time_t startTime = 0, stopTime = 0;
-
-    bool success() {
-        return status == Built || status == Substituted || status == AlreadyValid || status == ResolvesToAlreadyValid;
-    }
-};
 
 struct StoreConfig : public Config
 {
diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc
index ecd7279e9..1ebc177f5 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@@ -2,6 +2,7 @@
 #include "derivations.hh"
 #include "dotgraph.hh"
 #include "globals.hh"
+#include "build-result.hh"
 #include "local-store.hh"
 #include "monitor-fd.hh"
 #include "serve-protocol.hh"

From b5cd3e2d5c330b62cd1d162fd6ad841bf2a8d32b Mon Sep 17 00:00:00 2001
From: Anders Kaseorg <andersk@mit.edu>
Date: Tue, 1 Mar 2022 15:08:36 -0800
Subject: [PATCH 34/52] filterANSIEscapes: Ignore BEL character

GCC is not as good at music as it seems to think it is.  Fixes #4546.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
---
 src/libutil/util.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 88c5ae806..229bebbe6 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1412,7 +1412,7 @@ std::string filterANSIEscapes(const std::string & s, bool filterAll, unsigned in
             }
         }
 
-        else if (*i == '\r')
+        else if (*i == '\r' || *i == '\a')
             // do nothing for now
             i++;
 

From 010ffc31f8e215a348fb77d99086bf854bf32b0c Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 11:20:32 +0100
Subject: [PATCH 35/52] Remove stray debug line

---
 src/libmain/shared.cc | 2 --
 1 file changed, 2 deletions(-)

diff --git a/src/libmain/shared.cc b/src/libmain/shared.cc
index 47fc7ab2e..a0b0f4cb3 100644
--- a/src/libmain/shared.cc
+++ b/src/libmain/shared.cc
@@ -227,8 +227,6 @@ LegacyArgs::LegacyArgs(const std::string & programName,
     std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg)
     : MixCommonArgs(programName), parseArg(parseArg)
 {
-    printError("FOO %s", programName);
-    
     addFlag({
         .longName = "no-build-output",
         .shortName = 'Q',

From c10865a46e6e3083ceb2c6a450568fa2df91ec99 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 11:14:31 +0100
Subject: [PATCH 36/52] tests: Rename nix-profile.sh -> bash-profile.sh

---
 tests/{nix-profile.sh => bash-profile.sh} | 0
 tests/local.mk                            | 2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename tests/{nix-profile.sh => bash-profile.sh} (100%)

diff --git a/tests/nix-profile.sh b/tests/bash-profile.sh
similarity index 100%
rename from tests/nix-profile.sh
rename to tests/bash-profile.sh
diff --git a/tests/local.mk b/tests/local.mk
index 53a9179a3..aba5aa651 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -89,7 +89,7 @@ nix_tests = \
   build.sh \
   ca/nix-run.sh \
   db-migration.sh \
-  nix-profile.sh \
+  bash-profile.sh \
   pass-as-file.sh \
   describe-stores.sh \
   store-ping.sh

From b39ef074140485c528cab29064318c8fe1254f6b Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 11:46:15 +0100
Subject: [PATCH 37/52] Style

---
 src/nix/profile.cc | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index 0e8dc4380..82507db2c 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -373,15 +373,15 @@ struct CmdProfileRemove : virtual EvalCommand, MixDefaultProfile, MixProfileElem
 
         if (removedCount == 0) {
             for (auto matcher: matchers) {
-                if (const size_t* index = std::get_if<size_t>(&matcher)){
-                    warn("'%d' is not a valid index in profile", *index);
-                } else if (const Path* path = std::get_if<Path>(&matcher)){
-                    warn("'%s' does not match any paths in profile", *path);
-                } else if (const RegexPattern* regex = std::get_if<RegexPattern>(&matcher)){
-                    warn("'%s' does not match any packages in profile", regex->pattern);
+                if (const size_t * index = std::get_if<size_t>(&matcher)){
+                    warn("'%d' is not a valid index", *index);
+                } else if (const Path * path = std::get_if<Path>(&matcher)){
+                    warn("'%s' does not match any paths", *path);
+                } else if (const RegexPattern * regex = std::get_if<RegexPattern>(&matcher)){
+                    warn("'%s' does not match any packages", regex->pattern);
                 }
             }
-            warn ("Try `nix profile list` to see the current profile.");
+            warn ("Use 'nix profile list' to see the current profile.");
         }
         updateProfile(newManifest.build(store));
     }
@@ -454,12 +454,12 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
 
         if (upgradedCount == 0) {
             for (auto & matcher : matchers) {
-                if (const size_t* index = std::get_if<size_t>(&matcher)){
-                    warn("'%d' is not a valid index in profile", *index);
-                } else if (const Path* path = std::get_if<Path>(&matcher)){
-                    warn("'%s' does not match any paths in profile", *path);
-                } else if (const RegexPattern* regex = std::get_if<RegexPattern>(&matcher)){
-                    warn("'%s' does not match any packages in profile", regex->pattern);
+                if (const size_t * index = std::get_if<size_t>(&matcher)){
+                    warn("'%d' is not a valid index", *index);
+                } else if (const Path * path = std::get_if<Path>(&matcher)){
+                    warn("'%s' does not match any paths", *path);
+                } else if (const RegexPattern * regex = std::get_if<RegexPattern>(&matcher)){
+                    warn("'%s' does not match any packages", regex->pattern);
                 }
             }
             warn ("Use 'nix profile list' to see the current profile.");

From 5850fd17b4aff50ac9f6b5f8570acc5cf4f43226 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 11:46:24 +0100
Subject: [PATCH 38/52] Add basic tests for 'nix profile'

Fixes #6193.
---
 tests/local.mk       |  3 +-
 tests/nix-profile.sh | 68 ++++++++++++++++++++++++++++++++++++++++++++
 tests/user-envs.sh   |  1 -
 3 files changed, 70 insertions(+), 2 deletions(-)
 create mode 100644 tests/nix-profile.sh

diff --git a/tests/local.mk b/tests/local.mk
index aba5aa651..c3a6aa1fc 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -92,7 +92,8 @@ nix_tests = \
   bash-profile.sh \
   pass-as-file.sh \
   describe-stores.sh \
-  store-ping.sh
+  store-ping.sh \
+  nix-profile.sh
 
 ifeq ($(HAVE_LIBCPUID), 1)
 	nix_tests += compute-levels.sh
diff --git a/tests/nix-profile.sh b/tests/nix-profile.sh
new file mode 100644
index 000000000..f134d70a4
--- /dev/null
+++ b/tests/nix-profile.sh
@@ -0,0 +1,68 @@
+source common.sh
+
+clearStore
+clearProfiles
+
+# Make a flake.
+flake1Dir=$TEST_ROOT/flake1
+mkdir -p $flake1Dir
+
+cat > $flake1Dir/flake.nix <<EOF
+{
+  description = "Bla bla";
+
+  outputs = { self }: with import ./config.nix; rec {
+    packages.$system.default = mkDerivation {
+      name = "simple-\${builtins.readFile ./version}";
+      builder = builtins.toFile "builder.sh"
+        ''
+          mkdir -p \$out/bin
+          cat > \$out/bin/hello <<EOF
+          #! ${shell}
+          echo Hello \${builtins.readFile ./who}
+          EOF
+          chmod +x \$out/bin/hello
+        '';
+    };
+  };
+}
+EOF
+
+printf World > $flake1Dir/who
+printf 1.0 > $flake1Dir/version
+
+cp ./config.nix $flake1Dir/
+
+# Test upgrading from nix-env.
+nix-env -f ./user-envs.nix -i foo-1.0
+nix profile list | grep '0 - - .*-foo-1.0'
+nix profile install $flake1Dir -L
+[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello World" ]]
+nix profile history
+nix profile history | grep "packages.$system.default: ∅ -> 1.0"
+nix profile diff-closures | grep 'env-manifest.nix: ε → ∅'
+
+# Test upgrading a package.
+printf NixOS > $flake1Dir/who
+printf 2.0 > $flake1Dir/version
+nix profile upgrade 1
+[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello NixOS" ]]
+nix profile history | grep "packages.$system.default: 1.0 -> 2.0"
+
+# Test 'history', 'diff-closures'.
+nix profile diff-closures
+
+# Test rollback.
+nix profile rollback
+[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello World" ]]
+
+# Test uninstall.
+[ -e $TEST_HOME/.nix-profile/bin/foo ]
+nix profile remove 0
+(! [ -e $TEST_HOME/.nix-profile/bin/foo ])
+nix profile history | grep 'foo: 1.0 -> ∅'
+nix profile diff-closures | grep 'Version 3 -> 4'
+
+# Test wipe-history.
+nix profile wipe-history
+[[ $(nix profile history | grep Version | wc -l) -eq 1 ]]
diff --git a/tests/user-envs.sh b/tests/user-envs.sh
index aebf6a2a2..430688de1 100644
--- a/tests/user-envs.sh
+++ b/tests/user-envs.sh
@@ -9,7 +9,6 @@ clearProfiles
 # Query installed: should be empty.
 test "$(nix-env -p $profiles/test -q '*' | wc -l)" -eq 0
 
-mkdir -p $TEST_HOME
 nix-env --switch-profile $profiles/test
 
 # Query available: should contain several.

From 54888b92ded6c242ce4914628553d8b2c9c55d10 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 13:54:08 +0100
Subject: [PATCH 39/52] Move installables-related operations

---
 src/libcmd/command.cc      |  2 +-
 src/libcmd/command.hh      | 54 ----------------------------------
 src/libcmd/installables.cc | 14 ++++-----
 src/libcmd/installables.hh | 60 ++++++++++++++++++++++++++++++++++++++
 src/nix/app.cc             |  2 +-
 src/nix/build.cc           |  2 +-
 src/nix/develop.cc         |  7 +++--
 src/nix/diff-closures.cc   |  4 +--
 src/nix/profile.cc         |  2 +-
 src/nix/run.cc             |  2 +-
 src/nix/show-derivation.cc |  2 +-
 src/nix/why-depends.cc     |  4 +--
 12 files changed, 81 insertions(+), 74 deletions(-)

diff --git a/src/libcmd/command.cc b/src/libcmd/command.cc
index 6d183dfad..dc8fa9e5a 100644
--- a/src/libcmd/command.cc
+++ b/src/libcmd/command.cc
@@ -153,7 +153,7 @@ void BuiltPathsCommand::run(ref<Store> store)
         for (auto & p : store->queryAllValidPaths())
             paths.push_back(BuiltPath::Opaque{p});
     } else {
-        paths = toBuiltPaths(getEvalStore(), store, realiseMode, operateOn, installables);
+        paths = Installable::toBuiltPaths(getEvalStore(), store, realiseMode, operateOn, installables);
         if (recursive) {
             // XXX: This only computes the store path closure, ignoring
             // intermediate realisations
diff --git a/src/libcmd/command.hh b/src/libcmd/command.hh
index bd2a0a7ee..0f6125f11 100644
--- a/src/libcmd/command.hh
+++ b/src/libcmd/command.hh
@@ -5,7 +5,6 @@
 #include "common-eval-args.hh"
 #include "path.hh"
 #include "flake/lockfile.hh"
-#include "store-api.hh"
 
 #include <optional>
 
@@ -82,14 +81,6 @@ struct MixFlakeOptions : virtual Args, EvalCommand
     { return {}; }
 };
 
-/* How to handle derivations in commands that operate on store paths. */
-enum class OperateOn {
-    /* Operate on the output path. */
-    Output,
-    /* Operate on the .drv path. */
-    Derivation
-};
-
 struct SourceExprCommand : virtual Args, MixFlakeOptions
 {
     std::optional<Path> file;
@@ -113,19 +104,6 @@ struct SourceExprCommand : virtual Args, MixFlakeOptions
     void completeInstallable(std::string_view prefix);
 };
 
-enum class Realise {
-    /* Build the derivation. Postcondition: the
-       derivation outputs exist. */
-    Outputs,
-    /* Don't build the derivation. Postcondition: the store derivation
-       exists. */
-    Derivation,
-    /* Evaluate in dry-run mode. Postcondition: nothing. */
-    // FIXME: currently unused, but could be revived if we can
-    // evaluate derivations in-memory.
-    Nothing
-};
-
 /* A command that operates on a list of "installables", which can be
    store paths, attribute paths, Nix expressions, etc. */
 struct InstallablesCommand : virtual Args, SourceExprCommand
@@ -238,38 +216,6 @@ static RegisterCommand registerCommand2(std::vector<std::string> && name)
     return RegisterCommand(std::move(name), [](){ return make_ref<T>(); });
 }
 
-BuiltPaths build(
-    ref<Store> evalStore,
-    ref<Store> store, Realise mode,
-    const std::vector<std::shared_ptr<Installable>> & installables,
-    BuildMode bMode = bmNormal);
-
-std::set<StorePath> toStorePaths(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode,
-    OperateOn operateOn,
-    const std::vector<std::shared_ptr<Installable>> & installables);
-
-StorePath toStorePath(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode,
-    OperateOn operateOn,
-    std::shared_ptr<Installable> installable);
-
-std::set<StorePath> toDerivations(
-    ref<Store> store,
-    const std::vector<std::shared_ptr<Installable>> & installables,
-    bool useDeriver = false);
-
-BuiltPaths toBuiltPaths(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode,
-    OperateOn operateOn,
-    const std::vector<std::shared_ptr<Installable>> & installables);
-
 /* Helper function to generate args that invoke $EDITOR on
    filename:lineno. */
 Strings editorFor(const Pos & pos);
diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index c07e39628..b9afe5105 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -787,7 +787,7 @@ BuiltPaths getBuiltPaths(ref<Store> evalStore, ref<Store> store, const DerivedPa
     return res;
 }
 
-BuiltPaths build(
+BuiltPaths Installable::build(
     ref<Store> evalStore,
     ref<Store> store,
     Realise mode,
@@ -812,7 +812,7 @@ BuiltPaths build(
     return getBuiltPaths(evalStore, store, pathsToBuild);
 }
 
-BuiltPaths toBuiltPaths(
+BuiltPaths Installable::toBuiltPaths(
     ref<Store> evalStore,
     ref<Store> store,
     Realise mode,
@@ -820,19 +820,19 @@ BuiltPaths toBuiltPaths(
     const std::vector<std::shared_ptr<Installable>> & installables)
 {
     if (operateOn == OperateOn::Output)
-        return build(evalStore, store, mode, installables);
+        return Installable::build(evalStore, store, mode, installables);
     else {
         if (mode == Realise::Nothing)
             settings.readOnlyMode = true;
 
         BuiltPaths res;
-        for (auto & drvPath : toDerivations(store, installables, true))
+        for (auto & drvPath : Installable::toDerivations(store, installables, true))
             res.push_back(BuiltPath::Opaque{drvPath});
         return res;
     }
 }
 
-StorePathSet toStorePaths(
+StorePathSet Installable::toStorePaths(
     ref<Store> evalStore,
     ref<Store> store,
     Realise mode, OperateOn operateOn,
@@ -846,7 +846,7 @@ StorePathSet toStorePaths(
     return outPaths;
 }
 
-StorePath toStorePath(
+StorePath Installable::toStorePath(
     ref<Store> evalStore,
     ref<Store> store,
     Realise mode, OperateOn operateOn,
@@ -860,7 +860,7 @@ StorePath toStorePath(
     return *paths.begin();
 }
 
-StorePathSet toDerivations(
+StorePathSet Installable::toDerivations(
     ref<Store> store,
     const std::vector<std::shared_ptr<Installable>> & installables,
     bool useDeriver)
diff --git a/src/libcmd/installables.hh b/src/libcmd/installables.hh
index 3d2563e4b..f296434c5 100644
--- a/src/libcmd/installables.hh
+++ b/src/libcmd/installables.hh
@@ -5,6 +5,7 @@
 #include "path-with-outputs.hh"
 #include "derived-path.hh"
 #include "eval.hh"
+#include "store-api.hh"
 #include "flake/flake.hh"
 
 #include <optional>
@@ -29,6 +30,27 @@ struct UnresolvedApp
     App resolve(ref<Store> evalStore, ref<Store> store);
 };
 
+enum class Realise {
+    /* Build the derivation. Postcondition: the
+       derivation outputs exist. */
+    Outputs,
+    /* Don't build the derivation. Postcondition: the store derivation
+       exists. */
+    Derivation,
+    /* Evaluate in dry-run mode. Postcondition: nothing. */
+    // FIXME: currently unused, but could be revived if we can
+    // evaluate derivations in-memory.
+    Nothing
+};
+
+/* How to handle derivations in commands that operate on store paths. */
+enum class OperateOn {
+    /* Operate on the output path. */
+    Output,
+    /* Operate on the .drv path. */
+    Derivation
+};
+
 struct Installable
 {
     virtual ~Installable() { }
@@ -68,6 +90,39 @@ struct Installable
     {
         return FlakeRef::fromAttrs({{"type","indirect"}, {"id", "nixpkgs"}});
     }
+
+    static BuiltPaths build(
+        ref<Store> evalStore,
+        ref<Store> store,
+        Realise mode,
+        const std::vector<std::shared_ptr<Installable>> & installables,
+        BuildMode bMode = bmNormal);
+
+    static std::set<StorePath> toStorePaths(
+        ref<Store> evalStore,
+        ref<Store> store,
+        Realise mode,
+        OperateOn operateOn,
+        const std::vector<std::shared_ptr<Installable>> & installables);
+
+    static StorePath toStorePath(
+        ref<Store> evalStore,
+        ref<Store> store,
+        Realise mode,
+        OperateOn operateOn,
+        std::shared_ptr<Installable> installable);
+
+    static std::set<StorePath> toDerivations(
+        ref<Store> store,
+        const std::vector<std::shared_ptr<Installable>> & installables,
+        bool useDeriver = false);
+
+    static BuiltPaths toBuiltPaths(
+        ref<Store> evalStore,
+        ref<Store> store,
+        Realise mode,
+        OperateOn operateOn,
+        const std::vector<std::shared_ptr<Installable>> & installables);
 };
 
 struct InstallableValue : Installable
@@ -131,4 +186,9 @@ ref<eval_cache::EvalCache> openEvalCache(
     EvalState & state,
     std::shared_ptr<flake::LockedFlake> lockedFlake);
 
+BuiltPaths getBuiltPaths(
+    ref<Store> evalStore,
+    ref<Store> store,
+    const DerivedPaths & hopefullyBuiltPaths);
+
 }
diff --git a/src/nix/app.cc b/src/nix/app.cc
index e104cc9c1..2563180fb 100644
--- a/src/nix/app.cc
+++ b/src/nix/app.cc
@@ -114,7 +114,7 @@ App UnresolvedApp::resolve(ref<Store> evalStore, ref<Store> store)
         installableContext.push_back(
             std::make_shared<InstallableDerivedPath>(store, ctxElt.toDerivedPath()));
 
-    auto builtContext = build(evalStore, store, Realise::Outputs, installableContext);
+    auto builtContext = Installable::build(evalStore, store, Realise::Outputs, installableContext);
     res.program = resolveString(*store, unresolved.program, builtContext);
     if (!store->isInStore(res.program))
         throw Error("app program '%s' is not in the Nix store", res.program);
diff --git a/src/nix/build.cc b/src/nix/build.cc
index 6e31757a2..680db1c60 100644
--- a/src/nix/build.cc
+++ b/src/nix/build.cc
@@ -52,7 +52,7 @@ struct CmdBuild : InstallablesCommand, MixDryRun, MixJSON, MixProfile
 
     void run(ref<Store> store) override
     {
-        auto buildables = build(
+        auto buildables = Installable::build(
             getEvalStore(), store,
             dryRun ? Realise::Derivation : Realise::Outputs,
             installables, buildMode);
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index 92e31599a..8af5da9d0 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -307,7 +307,7 @@ struct Common : InstallableCommand, MixProfile
         for (auto & [installable_, dir_] : redirects) {
             auto dir = absPath(dir_);
             auto installable = parseInstallable(store, installable_);
-            auto builtPaths = toStorePaths(
+            auto builtPaths = Installable::toStorePaths(
                 getEvalStore(), store, Realise::Nothing, OperateOn::Output, {installable});
             for (auto & path: builtPaths) {
                 auto from = store->printStorePath(path);
@@ -347,7 +347,7 @@ struct Common : InstallableCommand, MixProfile
         if (path && hasSuffix(path->to_string(), "-env"))
             return *path;
         else {
-            auto drvs = toDerivations(store, {installable});
+            auto drvs = Installable::toDerivations(store, {installable});
 
             if (drvs.size() != 1)
                 throw Error("'%s' needs to evaluate to a single derivation, but it evaluated to %d derivations",
@@ -511,7 +511,8 @@ struct CmdDevelop : Common, MixEnvironment
                 nixpkgsLockFlags);
 
             shell = store->printStorePath(
-                toStorePath(getEvalStore(), store, Realise::Outputs, OperateOn::Output, bashInstallable)) + "/bin/bash";
+                Installable::toStorePath(getEvalStore(), store, Realise::Outputs, OperateOn::Output, bashInstallable))
+                + "/bin/bash";
         } catch (Error &) {
             ignoreException();
         }
diff --git a/src/nix/diff-closures.cc b/src/nix/diff-closures.cc
index 734c41e0e..0621d662c 100644
--- a/src/nix/diff-closures.cc
+++ b/src/nix/diff-closures.cc
@@ -131,9 +131,9 @@ struct CmdDiffClosures : SourceExprCommand
     void run(ref<Store> store) override
     {
         auto before = parseInstallable(store, _before);
-        auto beforePath = toStorePath(getEvalStore(), store, Realise::Outputs, operateOn, before);
+        auto beforePath = Installable::toStorePath(getEvalStore(), store, Realise::Outputs, operateOn, before);
         auto after = parseInstallable(store, _after);
-        auto afterPath = toStorePath(getEvalStore(), store, Realise::Outputs, operateOn, after);
+        auto afterPath = Installable::toStorePath(getEvalStore(), store, Realise::Outputs, operateOn, after);
         printClosureDiff(store, beforePath, afterPath, "");
     }
 };
diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index 82507db2c..c1bf62357 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -252,7 +252,7 @@ struct CmdProfileInstall : InstallablesCommand, MixDefaultProfile
 
                 manifest.elements.emplace_back(std::move(element));
             } else {
-                auto buildables = build(getEvalStore(), store, Realise::Outputs, {installable}, bmNormal);
+                auto buildables = Installable::build(getEvalStore(), store, Realise::Outputs, {installable}, bmNormal);
 
                 for (auto & buildable : buildables) {
                     ProfileElement element;
diff --git a/src/nix/run.cc b/src/nix/run.cc
index a67c23bcb..033263c36 100644
--- a/src/nix/run.cc
+++ b/src/nix/run.cc
@@ -91,7 +91,7 @@ struct CmdShell : InstallablesCommand, MixEnvironment
 
     void run(ref<Store> store) override
     {
-        auto outPaths = toStorePaths(getEvalStore(), store, Realise::Outputs, OperateOn::Output, installables);
+        auto outPaths = Installable::toStorePaths(getEvalStore(), store, Realise::Outputs, OperateOn::Output, installables);
 
         auto accessor = store->getFSAccessor();
 
diff --git a/src/nix/show-derivation.cc b/src/nix/show-derivation.cc
index c614be68d..61a02c9b3 100644
--- a/src/nix/show-derivation.cc
+++ b/src/nix/show-derivation.cc
@@ -40,7 +40,7 @@ struct CmdShowDerivation : InstallablesCommand
 
     void run(ref<Store> store) override
     {
-        auto drvPaths = toDerivations(store, installables, true);
+        auto drvPaths = Installable::toDerivations(store, installables, true);
 
         if (recursive) {
             StorePathSet closure;
diff --git a/src/nix/why-depends.cc b/src/nix/why-depends.cc
index f7a3ec3a0..1d9ab28ba 100644
--- a/src/nix/why-depends.cc
+++ b/src/nix/why-depends.cc
@@ -82,9 +82,9 @@ struct CmdWhyDepends : SourceExprCommand
     void run(ref<Store> store) override
     {
         auto package = parseInstallable(store, _package);
-        auto packagePath = toStorePath(getEvalStore(), store, Realise::Outputs, operateOn, package);
+        auto packagePath = Installable::toStorePath(getEvalStore(), store, Realise::Outputs, operateOn, package);
         auto dependency = parseInstallable(store, _dependency);
-        auto dependencyPath = toStorePath(getEvalStore(), store, Realise::Derivation, operateOn, dependency);
+        auto dependencyPath = Installable::toStorePath(getEvalStore(), store, Realise::Derivation, operateOn, dependency);
         auto dependencyPathHash = dependencyPath.hashPart();
 
         StorePathSet closure;

From 161f798aa13b56c5f71120a8cb5788409d9ab815 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 20:37:46 +0100
Subject: [PATCH 40/52] nix profile: Support CA derivations

---
 src/libcmd/installables.cc |  4 +-
 src/libcmd/installables.hh |  1 -
 src/nix/profile.cc         | 95 ++++++++++++++++++--------------------
 tests/nix-profile.sh       | 19 ++++++++
 4 files changed, 66 insertions(+), 53 deletions(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index b9afe5105..f18be5287 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -470,7 +470,6 @@ std::vector<InstallableValue::DerivationInfo> InstallableAttrPath::toDerivations
     for (auto & drvInfo : drvInfos) {
         res.push_back({
             state->store->parseStorePath(drvInfo.queryDrvPath()),
-            state->store->maybeParseStorePath(drvInfo.queryOutPath()),
             drvInfo.queryOutputName()
         });
     }
@@ -584,9 +583,8 @@ std::tuple<std::string, FlakeRef, InstallableValue::DerivationInfo> InstallableF
 
         auto drvPath = attr->forceDerivation();
 
-        auto drvInfo = DerivationInfo{
+        auto drvInfo = DerivationInfo {
             std::move(drvPath),
-            state->store->maybeParseStorePath(attr->getAttr(state->sOutPath)->getString()),
             attr->getAttr(state->sOutputName)->getString()
         };
 
diff --git a/src/libcmd/installables.hh b/src/libcmd/installables.hh
index f296434c5..e172b71b0 100644
--- a/src/libcmd/installables.hh
+++ b/src/libcmd/installables.hh
@@ -134,7 +134,6 @@ struct InstallableValue : Installable
     struct DerivationInfo
     {
         StorePath drvPath;
-        std::optional<StorePath> outPath;
         std::string outputName;
     };
 
diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index c1bf62357..48834d15b 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -61,6 +61,27 @@ struct ProfileElement
     {
         return std::tuple(describe(), storePaths) < std::tuple(other.describe(), other.storePaths);
     }
+
+    void updateStorePaths(ref<Store> evalStore, ref<Store> store, Installable & installable)
+    {
+        // FIXME: respect meta.outputsToInstall
+        storePaths.clear();
+        for (auto & buildable : getBuiltPaths(evalStore, store, installable.toDerivedPaths())) {
+            std::visit(overloaded {
+                [&](const BuiltPath::Opaque & bo) {
+                    storePaths.insert(bo.path);
+                },
+                [&](const BuiltPath::Built & bfd) {
+                    // TODO: Why are we querying if we know the output
+                    // names already? Is it just to figure out what the
+                    // default one is?
+                    for (auto & output : store->queryDerivationOutputMap(bfd.drvPath)) {
+                        storePaths.insert(output.second);
+                    }
+                },
+            }, buildable.raw());
+        }
+    }
 };
 
 struct ProfileManifest
@@ -232,53 +253,25 @@ struct CmdProfileInstall : InstallablesCommand, MixDefaultProfile
     {
         ProfileManifest manifest(*getEvalState(), *profile);
 
-        std::vector<DerivedPath> pathsToBuild;
+        auto builtPaths = Installable::build(getEvalStore(), store, Realise::Outputs, installables, bmNormal);
 
         for (auto & installable : installables) {
-            if (auto installable2 = std::dynamic_pointer_cast<InstallableFlake>(installable)) {
-                auto [attrPath, resolvedRef, drv] = installable2->toDerivation();
+            ProfileElement element;
 
-                ProfileElement element;
-                if (!drv.outPath)
-                    throw UnimplementedError("CA derivations are not yet supported by 'nix profile'");
-                element.storePaths = {*drv.outPath}; // FIXME
+            if (auto installable2 = std::dynamic_pointer_cast<InstallableFlake>(installable)) {
+                // FIXME: make build() return this?
+                auto [attrPath, resolvedRef, drv] = installable2->toDerivation();
                 element.source = ProfileElementSource{
                     installable2->flakeRef,
                     resolvedRef,
                     attrPath,
                 };
-
-                pathsToBuild.push_back(DerivedPath::Built{drv.drvPath, StringSet{drv.outputName}});
-
-                manifest.elements.emplace_back(std::move(element));
-            } else {
-                auto buildables = Installable::build(getEvalStore(), store, Realise::Outputs, {installable}, bmNormal);
-
-                for (auto & buildable : buildables) {
-                    ProfileElement element;
-
-                    std::visit(overloaded {
-                        [&](const BuiltPath::Opaque & bo) {
-                            pathsToBuild.push_back(bo);
-                            element.storePaths.insert(bo.path);
-                        },
-                        [&](const BuiltPath::Built & bfd) {
-                            // TODO: Why are we querying if we know the output
-                            // names already? Is it just to figure out what the
-                            // default one is?
-                            for (auto & output : store->queryDerivationOutputMap(bfd.drvPath)) {
-                                pathsToBuild.push_back(DerivedPath::Built{bfd.drvPath, {output.first}});
-                                element.storePaths.insert(output.second);
-                            }
-                        },
-                    }, buildable.raw());
-
-                    manifest.elements.emplace_back(std::move(element));
-                }
             }
-        }
 
-        store->buildPaths(pathsToBuild);
+            element.updateStorePaths(getEvalStore(), store, *installable);
+
+            manifest.elements.push_back(std::move(element));
+        }
 
         updateProfile(manifest.build(store));
     }
@@ -407,8 +400,8 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
 
         auto matchers = getMatchers(store);
 
-        // FIXME: code duplication
-        std::vector<DerivedPath> pathsToBuild;
+        std::vector<std::shared_ptr<Installable>> installables;
+        std::vector<size_t> indices;
 
         auto upgradedCount = 0;
 
@@ -423,32 +416,30 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
                 Activity act(*logger, lvlChatty, actUnknown,
                     fmt("checking '%s' for updates", element.source->attrPath));
 
-                InstallableFlake installable(
+                auto installable = std::make_shared<InstallableFlake>(
                     this,
                     getEvalState(),
                     FlakeRef(element.source->originalRef),
                     "",
-                    {element.source->attrPath},
-                    {},
+                    Strings{element.source->attrPath},
+                    Strings{},
                     lockFlags);
 
-                auto [attrPath, resolvedRef, drv] = installable.toDerivation();
+                auto [attrPath, resolvedRef, drv] = installable->toDerivation();
 
                 if (element.source->resolvedRef == resolvedRef) continue;
 
                 printInfo("upgrading '%s' from flake '%s' to '%s'",
                     element.source->attrPath, element.source->resolvedRef, resolvedRef);
 
-                if (!drv.outPath)
-                    throw UnimplementedError("CA derivations are not yet supported by 'nix profile'");
-                element.storePaths = {*drv.outPath}; // FIXME
                 element.source = ProfileElementSource{
-                    installable.flakeRef,
+                    installable->flakeRef,
                     resolvedRef,
                     attrPath,
                 };
 
-                pathsToBuild.push_back(DerivedPath::Built{drv.drvPath, {drv.outputName}});
+                installables.push_back(installable);
+                indices.push_back(i);
             }
         }
 
@@ -465,7 +456,13 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
             warn ("Use 'nix profile list' to see the current profile.");
         }
 
-        store->buildPaths(pathsToBuild);
+        auto builtPaths = Installable::build(getEvalStore(), store, Realise::Outputs, installables, bmNormal);
+
+        for (size_t i = 0; i < installables.size(); ++i) {
+            auto & installable = installables.at(i);
+            auto & element = manifest.elements[indices.at(i)];
+            element.updateStorePaths(getEvalStore(), store, *installable);
+        }
 
         updateProfile(manifest.build(store));
     }
diff --git a/tests/nix-profile.sh b/tests/nix-profile.sh
index f134d70a4..0ab69db22 100644
--- a/tests/nix-profile.sh
+++ b/tests/nix-profile.sh
@@ -22,7 +22,11 @@ cat > $flake1Dir/flake.nix <<EOF
           echo Hello \${builtins.readFile ./who}
           EOF
           chmod +x \$out/bin/hello
+          echo DONE
         '';
+      __contentAddressed = import ./ca.nix;
+      outputHashMode = "recursive";
+      outputHashAlgo = "sha256";
     };
   };
 }
@@ -30,6 +34,7 @@ EOF
 
 printf World > $flake1Dir/who
 printf 1.0 > $flake1Dir/version
+printf false > $flake1Dir/ca.nix
 
 cp ./config.nix $flake1Dir/
 
@@ -66,3 +71,17 @@ nix profile diff-closures | grep 'Version 3 -> 4'
 # Test wipe-history.
 nix profile wipe-history
 [[ $(nix profile history | grep Version | wc -l) -eq 1 ]]
+
+# Test upgrade to CA package.
+printf true > $flake1Dir/ca.nix
+printf 3.0 > $flake1Dir/version
+nix profile upgrade --extra-experimental-features ca-derivations 0
+nix profile history | grep "packages.$system.default: 1.0 -> 3.0"
+
+# Test new install of CA package.
+nix profile remove 0
+printf 4.0 > $flake1Dir/version
+printf Utrecht > $flake1Dir/who
+nix profile install --extra-experimental-features ca-derivations $flake1Dir
+[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello Utrecht" ]]
+[[ $(nix path-info --json $(realpath $TEST_HOME/.nix-profile/bin/hello) | jq -r .[].ca) =~ fixed:r:sha256: ]]

From f9375778aedf365436de8200a97c0c292df65ea3 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 20:56:40 +0100
Subject: [PATCH 41/52] nix profile: Add a test for non-flake packages

---
 tests/nix-profile.sh | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/tests/nix-profile.sh b/tests/nix-profile.sh
index 0ab69db22..549840767 100644
--- a/tests/nix-profile.sh
+++ b/tests/nix-profile.sh
@@ -13,7 +13,7 @@ cat > $flake1Dir/flake.nix <<EOF
 
   outputs = { self }: with import ./config.nix; rec {
     packages.$system.default = mkDerivation {
-      name = "simple-\${builtins.readFile ./version}";
+      name = "profile-test-\${builtins.readFile ./version}";
       builder = builtins.toFile "builder.sh"
         ''
           mkdir -p \$out/bin
@@ -68,6 +68,13 @@ nix profile remove 0
 nix profile history | grep 'foo: 1.0 -> ∅'
 nix profile diff-closures | grep 'Version 3 -> 4'
 
+# Test installing a non-flake package.
+nix profile install --file ./simple.nix ''
+[[ $(cat $TEST_HOME/.nix-profile/hello) = "Hello World!" ]]
+nix profile remove 1
+nix profile install $(nix-build --no-out-link ./simple.nix)
+[[ $(cat $TEST_HOME/.nix-profile/hello) = "Hello World!" ]]
+
 # Test wipe-history.
 nix profile wipe-history
 [[ $(nix profile history | grep Version | wc -l) -eq 1 ]]

From 5d208cbe416ed38693cd33643731fd001135a582 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 21:36:46 +0100
Subject: [PATCH 42/52] mk/run_test.sh: Add missing backslash

---
 mk/run_test.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mk/run_test.sh b/mk/run_test.sh
index b876859f8..7e95df2ac 100755
--- a/mk/run_test.sh
+++ b/mk/run_test.sh
@@ -28,7 +28,7 @@ run_test "$1"
 # See https://github.com/NixOS/nix/issues/3605 for more info
 if [[ $status -ne 0 && $status -ne 99 && \
     "$(uname)" == "Darwin" && \
-    "$log" =~ "unexpected EOF reading a line"
+    "$log" =~ "unexpected EOF reading a line" \
 ]]; then
     echo "$post_run_msg [${yellow}FAIL$normal] (possibly flaky, so will be retried)"
     echo "$log" | sed 's/^/    /'

From d2586188fe8745c34e5a97032d045f8b74100a98 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 21:48:25 +0100
Subject: [PATCH 43/52] tests/common.sh.in: Add enableFeatures helper

---
 tests/build-remote-content-addressed-floating.sh | 2 +-
 tests/ca/build.sh                                | 2 +-
 tests/ca/common.sh                               | 2 +-
 tests/ca/duplicate-realisation-in-closure.sh     | 2 --
 tests/ca/nix-copy.sh                             | 3 ---
 tests/ca/nix-run.sh                              | 2 --
 tests/ca/nix-shell.sh                            | 2 --
 tests/ca/post-hook.sh                            | 2 --
 tests/ca/recursive.sh                            | 2 --
 tests/ca/signatures.sh                           | 3 ---
 tests/common.sh.in                               | 7 ++++++-
 tests/nix-profile.sh                             | 6 ++++--
 12 files changed, 13 insertions(+), 22 deletions(-)

diff --git a/tests/build-remote-content-addressed-floating.sh b/tests/build-remote-content-addressed-floating.sh
index 13ef47d2d..1f474dde0 100644
--- a/tests/build-remote-content-addressed-floating.sh
+++ b/tests/build-remote-content-addressed-floating.sh
@@ -2,7 +2,7 @@ source common.sh
 
 file=build-hook-ca-floating.nix
 
-sed -i 's/experimental-features .*/& ca-derivations/' "$NIX_CONF_DIR"/nix.conf
+enableFeatures "ca-derivations ca-references"
 
 CONTENT_ADDRESSED=true
 
diff --git a/tests/ca/build.sh b/tests/ca/build.sh
index c8877f87f..92f8b429a 100644
--- a/tests/ca/build.sh
+++ b/tests/ca/build.sh
@@ -37,7 +37,7 @@ testCutoffFor () {
 }
 
 testCutoff () {
-    # Don't directly build depenentCA, that way we'll make sure we dodn't rely on
+    # Don't directly build dependentCA, that way we'll make sure we don't rely on
     # dependent derivations always being already built.
     #testDerivation dependentCA
     testCutoffFor transitivelyDependentCA
diff --git a/tests/ca/common.sh b/tests/ca/common.sh
index c5aa34334..b9d415863 100644
--- a/tests/ca/common.sh
+++ b/tests/ca/common.sh
@@ -1,5 +1,5 @@
 source ../common.sh
 
-sed -i 's/experimental-features .*/& ca-derivations ca-references/' "$NIX_CONF_DIR"/nix.conf
+enableFeatures "ca-derivations ca-references"
 
 restartDaemon
diff --git a/tests/ca/duplicate-realisation-in-closure.sh b/tests/ca/duplicate-realisation-in-closure.sh
index 74c5d25fd..da9cd8fb4 100644
--- a/tests/ca/duplicate-realisation-in-closure.sh
+++ b/tests/ca/duplicate-realisation-in-closure.sh
@@ -2,8 +2,6 @@ source ./common.sh
 
 requireDaemonNewerThan "2.4pre20210625"
 
-sed -i 's/experimental-features .*/& ca-derivations ca-references/' "$NIX_CONF_DIR"/nix.conf
-
 export REMOTE_STORE_DIR="$TEST_ROOT/remote_store"
 export REMOTE_STORE="file://$REMOTE_STORE_DIR"
 
diff --git a/tests/ca/nix-copy.sh b/tests/ca/nix-copy.sh
index 2e0dea2d2..7a8307a4e 100755
--- a/tests/ca/nix-copy.sh
+++ b/tests/ca/nix-copy.sh
@@ -2,9 +2,6 @@
 
 source common.sh
 
-# Globally enable the ca derivations experimental flag
-sed -i 's/experimental-features = .*/& ca-derivations ca-references/' "$NIX_CONF_DIR/nix.conf"
-
 export REMOTE_STORE_DIR="$TEST_ROOT/remote_store"
 export REMOTE_STORE="file://$REMOTE_STORE_DIR"
 
diff --git a/tests/ca/nix-run.sh b/tests/ca/nix-run.sh
index 81402af10..5f46518e8 100755
--- a/tests/ca/nix-run.sh
+++ b/tests/ca/nix-run.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-sed -i 's/experimental-features .*/& ca-derivations ca-references nix-command flakes/' "$NIX_CONF_DIR"/nix.conf
-
 FLAKE_PATH=path:$PWD
 
 nix run --no-write-lock-file $FLAKE_PATH#runnable
diff --git a/tests/ca/nix-shell.sh b/tests/ca/nix-shell.sh
index 7f1a3a73e..1c5a6639f 100755
--- a/tests/ca/nix-shell.sh
+++ b/tests/ca/nix-shell.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-sed -i 's/experimental-features .*/& ca-derivations ca-references nix-command flakes/' "$NIX_CONF_DIR"/nix.conf
-
 CONTENT_ADDRESSED=true
 cd ..
 source ./nix-shell.sh
diff --git a/tests/ca/post-hook.sh b/tests/ca/post-hook.sh
index 1c9d4f700..705bde9d4 100755
--- a/tests/ca/post-hook.sh
+++ b/tests/ca/post-hook.sh
@@ -4,8 +4,6 @@ source common.sh
 
 requireDaemonNewerThan "2.4pre20210626"
 
-sed -i 's/experimental-features .*/& ca-derivations ca-references nix-command flakes/' "$NIX_CONF_DIR"/nix.conf
-
 export NIX_TESTS_CA_BY_DEFAULT=1
 cd ..
 source ./post-hook.sh
diff --git a/tests/ca/recursive.sh b/tests/ca/recursive.sh
index 648bf0a91..0354d23b4 100755
--- a/tests/ca/recursive.sh
+++ b/tests/ca/recursive.sh
@@ -4,8 +4,6 @@ source common.sh
 
 requireDaemonNewerThan "2.4pre20210623"
 
-sed -i 's/experimental-features .*/& ca-derivations ca-references nix-command flakes/' "$NIX_CONF_DIR"/nix.conf
-
 export NIX_TESTS_CA_BY_DEFAULT=1
 cd ..
 source ./recursive.sh
diff --git a/tests/ca/signatures.sh b/tests/ca/signatures.sh
index 0c7d974ea..eb18a4130 100644
--- a/tests/ca/signatures.sh
+++ b/tests/ca/signatures.sh
@@ -1,8 +1,5 @@
 source common.sh
 
-# Globally enable the ca derivations experimental flag
-sed -i 's/experimental-features = .*/& ca-derivations ca-references/' "$NIX_CONF_DIR/nix.conf"
-
 clearStore
 clearCache
 
diff --git a/tests/common.sh.in b/tests/common.sh.in
index e485329ba..d12aebdad 100644
--- a/tests/common.sh.in
+++ b/tests/common.sh.in
@@ -173,10 +173,15 @@ needLocalStore() {
 }
 
 # Just to make it easy to find which tests should be fixed
-buggyNeedLocalStore () {
+buggyNeedLocalStore() {
   needLocalStore
 }
 
+enableFeatures() {
+    local features="$1"
+    sed -i 's/experimental-features .*/& '"$features"'/' "$NIX_CONF_DIR"/nix.conf
+}
+
 set -x
 
 if [[ -n "${NIX_DAEMON_PACKAGE:-}" ]]; then
diff --git a/tests/nix-profile.sh b/tests/nix-profile.sh
index 549840767..be80e089a 100644
--- a/tests/nix-profile.sh
+++ b/tests/nix-profile.sh
@@ -3,6 +3,8 @@ source common.sh
 clearStore
 clearProfiles
 
+enableFeatures "ca-derivations ca-references"
+
 # Make a flake.
 flake1Dir=$TEST_ROOT/flake1
 mkdir -p $flake1Dir
@@ -82,13 +84,13 @@ nix profile wipe-history
 # Test upgrade to CA package.
 printf true > $flake1Dir/ca.nix
 printf 3.0 > $flake1Dir/version
-nix profile upgrade --extra-experimental-features ca-derivations 0
+nix profile upgrade 0
 nix profile history | grep "packages.$system.default: 1.0 -> 3.0"
 
 # Test new install of CA package.
 nix profile remove 0
 printf 4.0 > $flake1Dir/version
 printf Utrecht > $flake1Dir/who
-nix profile install --extra-experimental-features ca-derivations $flake1Dir
+nix profile install $flake1Dir
 [[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello Utrecht" ]]
 [[ $(nix path-info --json $(realpath $TEST_HOME/.nix-profile/bin/hello) | jq -r .[].ca) =~ fixed:r:sha256: ]]

From b0d65b3d11496b81ed00616ce5d8e4db1229bb8c Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 22:22:23 +0100
Subject: [PATCH 44/52] Silence kill output

---
 tests/common.sh.in | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/common.sh.in b/tests/common.sh.in
index d12aebdad..b341993f7 100644
--- a/tests/common.sh.in
+++ b/tests/common.sh.in
@@ -109,10 +109,10 @@ startDaemon() {
 killDaemon() {
     kill $pidDaemon
     for i in {0..100}; do
-        kill -0 $pidDaemon || break
+        kill -0 $pidDaemon 2> /dev/null || break
         sleep 0.1
     done
-    kill -9 $pidDaemon || true
+    kill -9 $pidDaemon 2> /dev/null || true
     wait $pidDaemon || true
     trap "" EXIT
 }

From 3a3821bcd7c71e27ad1f6861e0d37d322f721b2b Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 22:22:55 +0100
Subject: [PATCH 45/52] Remove obsolete todo

---
 tests/common.sh.in | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tests/common.sh.in b/tests/common.sh.in
index b341993f7..8ce28d318 100644
--- a/tests/common.sh.in
+++ b/tests/common.sh.in
@@ -87,8 +87,7 @@ startDaemon() {
     if [[ "$NIX_REMOTE" == daemon ]]; then
       return
     fi
-    # Start the daemon, wait for the socket to appear.  !!!
-    # ‘nix-daemon’ should have an option to fork into the background.
+    # Start the daemon, wait for the socket to appear.
     rm -f $NIX_DAEMON_SOCKET_PATH
     PATH=$DAEMON_PATH nix-daemon&
     pidDaemon=$!

From d4538034b7fba772a5f87c2efa66dbbd76760142 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 23:08:49 +0100
Subject: [PATCH 46/52] nix profile test: Restart daemon

Fixes

  nix-daemon: src/libstore/sqlite.cc:97: nix::SQLiteStmt::Use::Use(nix::SQLiteStmt&): Assertion `stmt.stmt' failed.

which happens because the daemon doesn't properly handle the case
where ca-derivations isn't enabled at daemon startup.
---
 tests/nix-profile.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/nix-profile.sh b/tests/nix-profile.sh
index be80e089a..a7a4d4fa2 100644
--- a/tests/nix-profile.sh
+++ b/tests/nix-profile.sh
@@ -4,6 +4,7 @@ clearStore
 clearProfiles
 
 enableFeatures "ca-derivations ca-references"
+restartDaemon
 
 # Make a flake.
 flake1Dir=$TEST_ROOT/flake1

From b55d79728ccbd2581fa3aa7b2ec7f498aa2285d6 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 10:57:19 +0100
Subject: [PATCH 47/52] Add EvalState::coerceToStorePath() helper

This is useful whenever we want to evaluate something to a store path
(e.g. in get-drvs.cc).

Extracted from the lazy-trees branch (where we can require that a
store path must come from a store source tree accessor).
---
 src/libcmd/installables.cc             |  8 +--
 src/libexpr/eval.cc                    | 12 +++++
 src/libexpr/eval.hh                    |  3 ++
 src/libexpr/get-drvs.cc                | 33 +++++++-----
 src/libexpr/get-drvs.hh                | 16 +++---
 src/nix-build/nix-build.cc             | 11 ++--
 src/nix-env/nix-env.cc                 | 75 +++++++++++++-------------
 src/nix-env/user-env.cc                | 29 +++++-----
 src/nix-instantiate/nix-instantiate.cc |  9 ++--
 src/nix/bundle.cc                      |  4 +-
 src/nix/flake.cc                       |  2 +-
 src/nix/profile.cc                     |  2 +-
 src/nix/repl.cc                        | 20 +++----
 13 files changed, 123 insertions(+), 101 deletions(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index f18be5287..3209456bf 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -468,10 +468,10 @@ std::vector<InstallableValue::DerivationInfo> InstallableAttrPath::toDerivations
 
     std::vector<DerivationInfo> res;
     for (auto & drvInfo : drvInfos) {
-        res.push_back({
-            state->store->parseStorePath(drvInfo.queryDrvPath()),
-            drvInfo.queryOutputName()
-        });
+        auto drvPath = drvInfo.queryDrvPath();
+        if (!drvPath)
+            throw Error("'%s' is not a derivation", what());
+        res.push_back({ *drvPath, drvInfo.queryOutputName() });
     }
 
     return res;
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 8c5888497..193358161 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -2058,6 +2058,18 @@ Path EvalState::coerceToPath(const Pos & pos, Value & v, PathSet & context)
 }
 
 
+StorePath EvalState::coerceToStorePath(const Pos & pos, Value & v, PathSet & context)
+{
+    auto path = coerceToString(pos, v, context, false, false).toOwned();
+    if (auto storePath = store->maybeParseStorePath(path))
+        return *storePath;
+    throw EvalError({
+        .msg = hintfmt("path '%1%' is not in the Nix store", path),
+        .errPos = pos
+    });
+}
+
+
 bool EvalState::eqValues(Value & v1, Value & v2)
 {
     forceValue(v1, noPos);
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 36a53729a..800b00eef 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -272,6 +272,9 @@ public:
        path.  Nothing is copied to the store. */
     Path coerceToPath(const Pos & pos, Value & v, PathSet & context);
 
+    /* Like coerceToPath, but the result must be a store path. */
+    StorePath coerceToStorePath(const Pos & pos, Value & v, PathSet & context);
+
 public:
 
     /* The base environment, containing the builtin functions and
diff --git a/src/libexpr/get-drvs.cc b/src/libexpr/get-drvs.cc
index 8393e4225..7630c5ff4 100644
--- a/src/libexpr/get-drvs.cc
+++ b/src/libexpr/get-drvs.cc
@@ -22,7 +22,7 @@ DrvInfo::DrvInfo(EvalState & state, ref<Store> store, const std::string & drvPat
 {
     auto [drvPath, selectedOutputs] = parsePathWithOutputs(*store, drvPathWithOutputs);
 
-    this->drvPath = store->printStorePath(drvPath);
+    this->drvPath = drvPath;
 
     auto drv = store->derivationFromPath(drvPath);
 
@@ -41,9 +41,7 @@ DrvInfo::DrvInfo(EvalState & state, ref<Store> store, const std::string & drvPat
         throw Error("derivation '%s' does not have output '%s'", store->printStorePath(drvPath), outputName);
     auto & [outputName, output] = *i;
 
-    auto optStorePath = output.path(*store, drv.name, outputName);
-    if (optStorePath)
-        outPath = store->printStorePath(*optStorePath);
+    outPath = {output.path(*store, drv.name, outputName)};
 }
 
 
@@ -68,24 +66,35 @@ std::string DrvInfo::querySystem() const
 }
 
 
-std::string DrvInfo::queryDrvPath() const
+std::optional<StorePath> DrvInfo::queryDrvPath() const
 {
-    if (drvPath == "" && attrs) {
+    if (!drvPath && attrs) {
         Bindings::iterator i = attrs->find(state->sDrvPath);
         PathSet context;
-        drvPath = i != attrs->end() ? state->coerceToPath(*i->pos, *i->value, context) : "";
+        if (i == attrs->end())
+            drvPath = {std::nullopt};
+        else
+            drvPath = {state->coerceToStorePath(*i->pos, *i->value, context)};
     }
-    return drvPath;
+    return drvPath.value_or(std::nullopt);
 }
 
 
-std::string DrvInfo::queryOutPath() const
+StorePath DrvInfo::requireDrvPath() const
+{
+    if (auto drvPath = queryDrvPath())
+        return *drvPath;
+    throw Error("derivation does not contain a 'drvPath' attribute");
+}
+
+
+StorePath DrvInfo::queryOutPath() const
 {
     if (!outPath && attrs) {
         Bindings::iterator i = attrs->find(state->sOutPath);
         PathSet context;
         if (i != attrs->end())
-            outPath = state->coerceToPath(*i->pos, *i->value, context);
+            outPath = state->coerceToStorePath(*i->pos, *i->value, context);
     }
     if (!outPath)
         throw UnimplementedError("CA derivations are not yet supported");
@@ -113,10 +122,10 @@ DrvInfo::Outputs DrvInfo::queryOutputs(bool onlyOutputsToInstall)
                 Bindings::iterator outPath = out->value->attrs->find(state->sOutPath);
                 if (outPath == out->value->attrs->end()) continue; // FIXME: throw error?
                 PathSet context;
-                outputs[name] = state->coerceToPath(*outPath->pos, *outPath->value, context);
+                outputs.emplace(name, state->coerceToStorePath(*outPath->pos, *outPath->value, context));
             }
         } else
-            outputs["out"] = queryOutPath();
+            outputs.emplace("out", queryOutPath());
     }
     if (!onlyOutputsToInstall || !attrs)
         return outputs;
diff --git a/src/libexpr/get-drvs.hh b/src/libexpr/get-drvs.hh
index d13847785..3ca6f1fca 100644
--- a/src/libexpr/get-drvs.hh
+++ b/src/libexpr/get-drvs.hh
@@ -1,6 +1,7 @@
 #pragma once
 
 #include "eval.hh"
+#include "path.hh"
 
 #include <string>
 #include <map>
@@ -12,15 +13,15 @@ namespace nix {
 struct DrvInfo
 {
 public:
-    typedef std::map<std::string, Path> Outputs;
+    typedef std::map<std::string, StorePath> Outputs;
 
 private:
     EvalState * state;
 
     mutable std::string name;
     mutable std::string system;
-    mutable std::string drvPath;
-    mutable std::optional<std::string> outPath;
+    mutable std::optional<std::optional<StorePath>> drvPath;
+    mutable std::optional<StorePath> outPath;
     mutable std::string outputName;
     Outputs outputs;
 
@@ -41,8 +42,9 @@ public:
 
     std::string queryName() const;
     std::string querySystem() const;
-    std::string queryDrvPath() const;
-    std::string queryOutPath() const;
+    std::optional<StorePath> queryDrvPath() const;
+    StorePath requireDrvPath() const;
+    StorePath queryOutPath() const;
     std::string queryOutputName() const;
     /** Return the list of outputs. The "outputs to install" are determined by `meta.outputsToInstall`. */
     Outputs queryOutputs(bool onlyOutputsToInstall = false);
@@ -61,8 +63,8 @@ public:
     */
 
     void setName(const std::string & s) { name = s; }
-    void setDrvPath(const std::string & s) { drvPath = s; }
-    void setOutPath(const std::string & s) { outPath = s; }
+    void setDrvPath(StorePath path) { drvPath = {{std::move(path)}}; }
+    void setOutPath(StorePath path) { outPath = {{std::move(path)}}; }
 
     void setFailed() { failed = true; };
     bool hasFailed() { return failed; };
diff --git a/src/nix-build/nix-build.cc b/src/nix-build/nix-build.cc
index 3d189f934..795a4f7bd 100755
--- a/src/nix-build/nix-build.cc
+++ b/src/nix-build/nix-build.cc
@@ -346,7 +346,7 @@ static void main_nix_build(int argc, char * * argv)
             throw UsageError("nix-shell requires a single derivation");
 
         auto & drvInfo = drvs.front();
-        auto drv = evalStore->derivationFromPath(evalStore->parseStorePath(drvInfo.queryDrvPath()));
+        auto drv = evalStore->derivationFromPath(drvInfo.requireDrvPath());
 
         std::vector<StorePathWithOutputs> pathsToBuild;
         RealisedPath::Set pathsToCopy;
@@ -369,7 +369,7 @@ static void main_nix_build(int argc, char * * argv)
                 if (!drv)
                     throw Error("the 'bashInteractive' attribute in <nixpkgs> did not evaluate to a derivation");
 
-                auto bashDrv = store->parseStorePath(drv->queryDrvPath());
+                auto bashDrv = drv->requireDrvPath();
                 pathsToBuild.push_back({bashDrv});
                 pathsToCopy.insert(bashDrv);
                 shellDrv = bashDrv;
@@ -458,10 +458,7 @@ static void main_nix_build(int argc, char * * argv)
                 }
             }
 
-            ParsedDerivation parsedDrv(
-                StorePath(store->parseStorePath(drvInfo.queryDrvPath())),
-                drv
-            );
+            ParsedDerivation parsedDrv(drvInfo.requireDrvPath(), drv);
 
             if (auto structAttrs = parsedDrv.prepareStructuredAttrs(*store, inputs)) {
                 auto json = structAttrs.value();
@@ -553,7 +550,7 @@ static void main_nix_build(int argc, char * * argv)
         std::map<StorePath, std::pair<size_t, StringSet>> drvMap;
 
         for (auto & drvInfo : drvs) {
-            auto drvPath = store->parseStorePath(drvInfo.queryDrvPath());
+            auto drvPath = drvInfo.requireDrvPath();
 
             auto outputName = drvInfo.queryOutputName();
             if (outputName == "")
diff --git a/src/nix-env/nix-env.cc b/src/nix-env/nix-env.cc
index 12e08bbe1..24f2d2bf3 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix-env/nix-env.cc
@@ -211,7 +211,7 @@ static long comparePriorities(EvalState & state, DrvInfo & drv1, DrvInfo & drv2)
 // at a time.
 static bool isPrebuilt(EvalState & state, DrvInfo & elem)
 {
-    auto path = state.store->parseStorePath(elem.queryOutPath());
+    auto path = elem.queryOutPath();
     if (state.store->isValidPath(path)) return true;
     return state.store->querySubstitutablePaths({path}).count(path);
 }
@@ -429,14 +429,15 @@ static void queryInstSources(EvalState & state,
                 elem.setName(name);
 
                 if (path.isDerivation()) {
-                    elem.setDrvPath(state.store->printStorePath(path));
+                    elem.setDrvPath(path);
                     auto outputs = state.store->queryDerivationOutputMap(path);
-                    elem.setOutPath(state.store->printStorePath(outputs.at("out")));
+                    elem.setOutPath(outputs.at("out"));
                     if (name.size() >= drvExtension.size() &&
                         std::string(name, name.size() - drvExtension.size()) == drvExtension)
                         name = name.substr(0, name.size() - drvExtension.size());
                 }
-                else elem.setOutPath(state.store->printStorePath(path));
+                else
+                    elem.setOutPath(path);
 
                 elems.push_back(elem);
             }
@@ -470,13 +471,11 @@ static void queryInstSources(EvalState & state,
 static void printMissing(EvalState & state, DrvInfos & elems)
 {
     std::vector<DerivedPath> targets;
-    for (auto & i : elems) {
-        Path drvPath = i.queryDrvPath();
-        if (drvPath != "")
-            targets.push_back(DerivedPath::Built{state.store->parseStorePath(drvPath)});
+    for (auto & i : elems)
+        if (auto drvPath = i.queryDrvPath())
+            targets.push_back(DerivedPath::Built{*drvPath});
         else
-            targets.push_back(DerivedPath::Opaque{state.store->parseStorePath(i.queryOutPath())});
-    }
+            targets.push_back(DerivedPath::Opaque{i.queryOutPath()});
 
     printMissing(state.store, targets);
 }
@@ -744,14 +743,11 @@ static void opSet(Globals & globals, Strings opFlags, Strings opArgs)
     if (globals.forceName != "")
         drv.setName(globals.forceName);
 
+    auto drvPath = drv.queryDrvPath();
     std::vector<DerivedPath> paths {
-        (drv.queryDrvPath() != "")
-        ? (DerivedPath) (DerivedPath::Built {
-                globals.state->store->parseStorePath(drv.queryDrvPath())
-            })
-        : (DerivedPath) (DerivedPath::Opaque {
-                globals.state->store->parseStorePath(drv.queryOutPath())
-            }),
+        drvPath
+        ? (DerivedPath) (DerivedPath::Built { *drvPath })
+        : (DerivedPath) (DerivedPath::Opaque { drv.queryOutPath() }),
     };
     printMissing(globals.state->store, paths);
     if (globals.dryRun) return;
@@ -759,8 +755,9 @@ static void opSet(Globals & globals, Strings opFlags, Strings opArgs)
 
     debug(format("switching to new user environment"));
     Path generation = createGeneration(
-        ref<LocalFSStore>(store2), globals.profile,
-        store2->parseStorePath(drv.queryOutPath()));
+        ref<LocalFSStore>(store2),
+        globals.profile,
+        drv.queryOutPath());
     switchLink(globals.profile, generation);
 }
 
@@ -780,7 +777,7 @@ static void uninstallDerivations(Globals & globals, Strings & selectors,
                 split = std::partition(
                     workingElems.begin(), workingElems.end(),
                     [&selectorStorePath, globals](auto &elem) {
-                        return selectorStorePath != globals.state->store->parseStorePath(elem.queryOutPath());
+                        return selectorStorePath != elem.queryOutPath();
                     }
                 );
             } else {
@@ -925,9 +922,8 @@ static void queryJSON(Globals & globals, std::vector<DrvInfo> & elems, bool prin
             if (printOutPath) {
                 DrvInfo::Outputs outputs = i.queryOutputs();
                 JSONObject outputObj = pkgObj.object("outputs");
-                for (auto & j : outputs) {
-                    outputObj.attr(j.first, j.second);
-                }
+                for (auto & j : outputs)
+                    outputObj.attr(j.first, globals.state->store->printStorePath(j.second));
             }
 
             if (printMeta) {
@@ -957,6 +953,8 @@ static void queryJSON(Globals & globals, std::vector<DrvInfo> & elems, bool prin
 
 static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
 {
+    auto & store(*globals.state->store);
+
     Strings remaining;
     std::string attrPath;
 
@@ -1027,12 +1025,11 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
 
     /* We only need to know the installed paths when we are querying
        the status of the derivation. */
-    PathSet installed; /* installed paths */
+    StorePathSet installed; /* installed paths */
 
-    if (printStatus) {
+    if (printStatus)
         for (auto & i : installedElems)
             installed.insert(i.queryOutPath());
-    }
 
 
     /* Query which paths have substitutes. */
@@ -1042,13 +1039,13 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
         StorePathSet paths;
         for (auto & i : elems)
             try {
-                paths.insert(globals.state->store->parseStorePath(i.queryOutPath()));
+                paths.insert(i.queryOutPath());
             } catch (AssertionError & e) {
                 printMsg(lvlTalkative, "skipping derivation named '%s' which gives an assertion failure", i.queryName());
                 i.setFailed();
             }
-        validPaths = globals.state->store->queryValidPaths(paths);
-        substitutablePaths = globals.state->store->querySubstitutablePaths(paths);
+        validPaths = store.queryValidPaths(paths);
+        substitutablePaths = store.querySubstitutablePaths(paths);
     }
 
 
@@ -1073,8 +1070,8 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
             //Activity act(*logger, lvlDebug, format("outputting query result '%1%'") % i.attrPath);
 
             if (globals.prebuiltOnly &&
-                !validPaths.count(globals.state->store->parseStorePath(i.queryOutPath())) &&
-                !substitutablePaths.count(globals.state->store->parseStorePath(i.queryOutPath())))
+                !validPaths.count(i.queryOutPath()) &&
+                !substitutablePaths.count(i.queryOutPath()))
                 continue;
 
             /* For table output. */
@@ -1084,10 +1081,10 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
             XMLAttrs attrs;
 
             if (printStatus) {
-                Path outPath = i.queryOutPath();
-                bool hasSubs = substitutablePaths.count(globals.state->store->parseStorePath(outPath));
-                bool isInstalled = installed.find(outPath) != installed.end();
-                bool isValid = validPaths.count(globals.state->store->parseStorePath(outPath));
+                auto outPath = i.queryOutPath();
+                bool hasSubs = substitutablePaths.count(outPath);
+                bool isInstalled = installed.count(outPath);
+                bool isValid = validPaths.count(outPath);
                 if (xmlOutput) {
                     attrs["installed"] = isInstalled ? "1" : "0";
                     attrs["valid"] = isValid ? "1" : "0";
@@ -1152,9 +1149,9 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
             if (printDrvPath) {
                 auto drvPath = i.queryDrvPath();
                 if (xmlOutput) {
-                    if (drvPath != "") attrs["drvPath"] = drvPath;
+                    if (drvPath) attrs["drvPath"] = store.printStorePath(*drvPath);
                 } else
-                    columns.push_back(drvPath == "" ? "-" : drvPath);
+                    columns.push_back(drvPath ? store.printStorePath(*drvPath) : "-");
             }
 
             if (printOutPath && !xmlOutput) {
@@ -1163,7 +1160,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                 for (auto & j : outputs) {
                     if (!s.empty()) s += ';';
                     if (j.first != "out") { s += j.first; s += "="; }
-                    s += j.second;
+                    s += store.printStorePath(j.second);
                 }
                 columns.push_back(s);
             }
@@ -1184,7 +1181,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                         for (auto & j : outputs) {
                             XMLAttrs attrs2;
                             attrs2["name"] = j.first;
-                            attrs2["path"] = j.second;
+                            attrs2["path"] = store.printStorePath(j.second);
                             xml.writeEmptyElement("output", attrs2);
                         }
                     }
diff --git a/src/nix-env/user-env.cc b/src/nix-env/user-env.cc
index 37e4086cb..af4f350ff 100644
--- a/src/nix-env/user-env.cc
+++ b/src/nix-env/user-env.cc
@@ -38,8 +38,8 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
        exist already. */
     std::vector<StorePathWithOutputs> drvsToBuild;
     for (auto & i : elems)
-        if (i.queryDrvPath() != "")
-            drvsToBuild.push_back({state.store->parseStorePath(i.queryDrvPath())});
+        if (auto drvPath = i.queryDrvPath())
+            drvsToBuild.push_back({*drvPath});
 
     debug(format("building user environment dependencies"));
     state.store->buildPaths(
@@ -55,7 +55,7 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
         /* Create a pseudo-derivation containing the name, system,
            output paths, and optionally the derivation path, as well
            as the meta attributes. */
-        Path drvPath = keepDerivations ? i.queryDrvPath() : "";
+        std::optional<StorePath> drvPath = keepDerivations ? i.queryDrvPath() : std::nullopt;
         DrvInfo::Outputs outputs = i.queryOutputs(true);
         StringSet metaNames = i.queryMetaNames();
 
@@ -66,9 +66,9 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
         auto system = i.querySystem();
         if (!system.empty())
             attrs.alloc(state.sSystem).mkString(system);
-        attrs.alloc(state.sOutPath).mkString(i.queryOutPath());
-        if (drvPath != "")
-            attrs.alloc(state.sDrvPath).mkString(i.queryDrvPath());
+        attrs.alloc(state.sOutPath).mkString(state.store->printStorePath(i.queryOutPath()));
+        if (drvPath)
+            attrs.alloc(state.sDrvPath).mkString(state.store->printStorePath(*drvPath));
 
         // Copy each output meant for installation.
         auto & vOutputs = attrs.alloc(state.sOutputs);
@@ -76,15 +76,15 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
         for (const auto & [m, j] : enumerate(outputs)) {
             (vOutputs.listElems()[m] = state.allocValue())->mkString(j.first);
             auto outputAttrs = state.buildBindings(2);
-            outputAttrs.alloc(state.sOutPath).mkString(j.second);
+            outputAttrs.alloc(state.sOutPath).mkString(state.store->printStorePath(j.second));
             attrs.alloc(j.first).mkAttrs(outputAttrs);
 
             /* This is only necessary when installing store paths, e.g.,
                `nix-env -i /nix/store/abcd...-foo'. */
-            state.store->addTempRoot(state.store->parseStorePath(j.second));
-            state.store->ensurePath(state.store->parseStorePath(j.second));
+            state.store->addTempRoot(j.second);
+            state.store->ensurePath(j.second);
 
-            references.insert(state.store->parseStorePath(j.second));
+            references.insert(j.second);
         }
 
         // Copy the meta attributes.
@@ -99,7 +99,7 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
 
         (manifest.listElems()[n++] = state.allocValue())->mkAttrs(attrs);
 
-        if (drvPath != "") references.insert(state.store->parseStorePath(drvPath));
+        if (drvPath) references.insert(*drvPath);
     }
 
     /* Also write a copy of the list of user environment elements to
@@ -132,9 +132,9 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
     state.forceValue(topLevel, [&]() { return topLevel.determinePos(noPos); });
     PathSet context;
     Attr & aDrvPath(*topLevel.attrs->find(state.sDrvPath));
-    auto topLevelDrv = state.store->parseStorePath(state.coerceToPath(*aDrvPath.pos, *aDrvPath.value, context));
+    auto topLevelDrv = state.coerceToStorePath(*aDrvPath.pos, *aDrvPath.value, context);
     Attr & aOutPath(*topLevel.attrs->find(state.sOutPath));
-    Path topLevelOut = state.coerceToPath(*aOutPath.pos, *aOutPath.value, context);
+    auto topLevelOut = state.coerceToStorePath(*aOutPath.pos, *aOutPath.value, context);
 
     /* Realise the resulting store expression. */
     debug("building user environment");
@@ -158,8 +158,7 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
         }
 
         debug(format("switching to new user environment"));
-        Path generation = createGeneration(ref<LocalFSStore>(store2), profile,
-            store2->parseStorePath(topLevelOut));
+        Path generation = createGeneration(ref<LocalFSStore>(store2), profile, topLevelOut);
         switchLink(profile, generation);
     }
 
diff --git a/src/nix-instantiate/nix-instantiate.cc b/src/nix-instantiate/nix-instantiate.cc
index 12fc8baf9..3ec0e6e7c 100644
--- a/src/nix-instantiate/nix-instantiate.cc
+++ b/src/nix-instantiate/nix-instantiate.cc
@@ -61,12 +61,13 @@ void processExpr(EvalState & state, const Strings & attrPaths,
             DrvInfos drvs;
             getDerivations(state, v, "", autoArgs, drvs, false);
             for (auto & i : drvs) {
-                Path drvPath = i.queryDrvPath();
+                auto drvPath = i.requireDrvPath();
+                auto drvPathS = state.store->printStorePath(drvPath);
 
                 /* What output do we want? */
                 std::string outputName = i.queryOutputName();
                 if (outputName == "")
-                    throw Error("derivation '%1%' lacks an 'outputName' attribute ", drvPath);
+                    throw Error("derivation '%1%' lacks an 'outputName' attribute", drvPathS);
 
                 if (gcRoot == "")
                     printGCWarning();
@@ -75,9 +76,9 @@ void processExpr(EvalState & state, const Strings & attrPaths,
                     if (++rootNr > 1) rootName += "-" + std::to_string(rootNr);
                     auto store2 = state.store.dynamic_pointer_cast<LocalFSStore>();
                     if (store2)
-                        drvPath = store2->addPermRoot(store2->parseStorePath(drvPath), rootName);
+                        drvPathS = store2->addPermRoot(drvPath, rootName);
                 }
-                std::cout << fmt("%s%s\n", drvPath, (outputName != "out" ? "!" + outputName : ""));
+                std::cout << fmt("%s%s\n", drvPathS, (outputName != "out" ? "!" + outputName : ""));
             }
         }
     }
diff --git a/src/nix/bundle.cc b/src/nix/bundle.cc
index 6b891a6ee..7ed558dee 100644
--- a/src/nix/bundle.cc
+++ b/src/nix/bundle.cc
@@ -97,13 +97,13 @@ struct CmdBundle : InstallableCommand
             throw Error("the bundler '%s' does not produce a derivation", bundler.what());
 
         PathSet context2;
-        StorePath drvPath = store->parseStorePath(evalState->coerceToPath(*attr1->pos, *attr1->value, context2));
+        auto drvPath = evalState->coerceToStorePath(*attr1->pos, *attr1->value, context2);
 
         auto attr2 = vRes->attrs->get(evalState->sOutPath);
         if (!attr2)
             throw Error("the bundler '%s' does not produce a derivation", bundler.what());
 
-        StorePath outPath = store->parseStorePath(evalState->coerceToPath(*attr2->pos, *attr2->value, context2));
+        auto outPath = evalState->coerceToStorePath(*attr2->pos, *attr2->value, context2);
 
         store->buildPaths({ DerivedPath::Built { drvPath } });
 
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 14a235501..144f8f886 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -327,7 +327,7 @@ struct CmdFlakeCheck : FlakeCommand
                 if (!drvInfo)
                     throw Error("flake attribute '%s' is not a derivation", attrPath);
                 // FIXME: check meta attributes
-                return std::make_optional(store->parseStorePath(drvInfo->queryDrvPath()));
+                return drvInfo->queryDrvPath();
             } catch (Error & e) {
                 e.addTrace(pos, hintfmt("while checking the derivation '%s'", attrPath));
                 reportError(e);
diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index 48834d15b..a8ff9c78a 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -126,7 +126,7 @@ struct ProfileManifest
 
             for (auto & drvInfo : drvInfos) {
                 ProfileElement element;
-                element.storePaths = {state.store->parseStorePath(drvInfo.queryOutPath())};
+                element.storePaths = {drvInfo.queryOutPath()};
                 elements.emplace_back(std::move(element));
             }
         }
diff --git a/src/nix/repl.cc b/src/nix/repl.cc
index 731337004..5c0d44c68 100644
--- a/src/nix/repl.cc
+++ b/src/nix/repl.cc
@@ -384,13 +384,12 @@ StorePath NixRepl::getDerivationPath(Value & v) {
     auto drvInfo = getDerivation(*state, v, false);
     if (!drvInfo)
         throw Error("expression does not evaluate to a derivation, so I can't build it");
-    Path drvPathRaw = drvInfo->queryDrvPath();
-    if (drvPathRaw == "")
-        throw Error("expression did not evaluate to a valid derivation (no drv path)");
-    StorePath drvPath = state->store->parseStorePath(drvPathRaw);
-    if (!state->store->isValidPath(drvPath))
-        throw Error("expression did not evaluate to a valid derivation (invalid drv path)");
-    return drvPath;
+    auto drvPath = drvInfo->queryDrvPath();
+    if (!drvPath)
+        throw Error("expression did not evaluate to a valid derivation (no 'drvPath' attribute)");
+    if (!state->store->isValidPath(*drvPath))
+        throw Error("expression evaluated to invalid derivation '%s'", state->store->printStorePath(*drvPath));
+    return *drvPath;
 }
 
 
@@ -780,8 +779,11 @@ std::ostream & NixRepl::printValue(std::ostream & str, Value & v, unsigned int m
             str << "«derivation ";
             Bindings::iterator i = v.attrs->find(state->sDrvPath);
             PathSet context;
-            Path drvPath = i != v.attrs->end() ? state->coerceToPath(*i->pos, *i->value, context) : "???";
-            str << drvPath << "»";
+            if (i != v.attrs->end())
+                str << state->store->printStorePath(state->coerceToStorePath(*i->pos, *i->value, context));
+            else
+                str << "???";
+            str << "»";
         }
 
         else if (maxDepth > 0) {

From a7c835e9cb95ed573924f6f4a0ab0083058d6000 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 3 Mar 2022 10:02:11 +0100
Subject: [PATCH 48/52] Use C++11-style initializer

Co-authored-by: John Ericson <git@JohnEricson.me>
---
 src/nix-env/nix-env.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/nix-env/nix-env.cc b/src/nix-env/nix-env.cc
index 24f2d2bf3..40c3c5d65 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix-env/nix-env.cc
@@ -953,7 +953,7 @@ static void queryJSON(Globals & globals, std::vector<DrvInfo> & elems, bool prin
 
 static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
 {
-    auto & store(*globals.state->store);
+    auto & store { *globals.state->store };
 
     Strings remaining;
     std::string attrPath;

From 609779086301a600f4282a629d586bba6b6a485c Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 3 Mar 2022 11:11:16 +0100
Subject: [PATCH 49/52] Fix segfault in headerCallback()

https://hydra.nixos.org/build/168594664
---
 src/libexpr/flake/flakeref.cc  | 6 +++---
 src/libstore/filetransfer.cc   | 2 +-
 src/libutil/util.cc            | 4 ++--
 src/nix-channel/nix-channel.cc | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/libexpr/flake/flakeref.cc b/src/libexpr/flake/flakeref.cc
index 930ed9ccd..c1eae413f 100644
--- a/src/libexpr/flake/flakeref.cc
+++ b/src/libexpr/flake/flakeref.cc
@@ -98,7 +98,7 @@ std::pair<FlakeRef, std::string> parseFlakeRefWithFragment(
     if (std::regex_match(url, match, flakeRegex)) {
         auto parsedURL = ParsedURL{
             .url = url,
-            .base = "flake:" + std::string(match[1]),
+            .base = "flake:" + match.str(1),
             .scheme = "flake",
             .authority = "",
             .path = match[1],
@@ -106,12 +106,12 @@ std::pair<FlakeRef, std::string> parseFlakeRefWithFragment(
 
         return std::make_pair(
             FlakeRef(Input::fromURL(parsedURL), ""),
-            percentDecode(std::string(match[6])));
+            percentDecode(match.str(6)));
     }
 
     else if (std::regex_match(url, match, pathUrlRegex)) {
         std::string path = match[1];
-        std::string fragment = percentDecode(std::string(match[3]));
+        std::string fragment = percentDecode(match.str(3));
 
         if (baseDir) {
             /* Check if 'url' is a path (either absolute or relative
diff --git a/src/libstore/filetransfer.cc b/src/libstore/filetransfer.cc
index 255b42c49..c46262299 100644
--- a/src/libstore/filetransfer.cc
+++ b/src/libstore/filetransfer.cc
@@ -197,7 +197,7 @@ struct curlFileTransfer : public FileTransfer
                 result.etag = "";
                 result.data.clear();
                 result.bodySize = 0;
-                statusMsg = trim((std::string &) match[1]);
+                statusMsg = trim(match.str(1));
                 acceptRanges = false;
                 encoding = "";
             } else {
diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 229bebbe6..b833038a9 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1263,9 +1263,9 @@ std::string chomp(std::string_view s)
 std::string trim(std::string_view s, std::string_view whitespace)
 {
     auto i = s.find_first_not_of(whitespace);
-    if (i == std::string_view::npos) return "";
+    if (i == s.npos) return "";
     auto j = s.find_last_not_of(whitespace);
-    return std::string(s, i, j == std::string::npos ? j : j - i + 1);
+    return std::string(s, i, j == s.npos ? j : j - i + 1);
 }
 
 
diff --git a/src/nix-channel/nix-channel.cc b/src/nix-channel/nix-channel.cc
index f46b90b90..cf52b03b4 100755
--- a/src/nix-channel/nix-channel.cc
+++ b/src/nix-channel/nix-channel.cc
@@ -96,7 +96,7 @@ static void update(const StringSet & channelNames)
         std::smatch match;
         auto urlBase = std::string(baseNameOf(url));
         if (std::regex_search(urlBase, match, std::regex("(-\\d.*)$")))
-            cname = cname + (std::string) match[1];
+            cname = cname + match.str(1);
 
         std::string extraAttrs;
 

From ecff9d969acef5a08d3963d16eac83a5210de86e Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 3 Mar 2022 13:07:50 +0100
Subject: [PATCH 50/52] printValue(): Don't show repeated values

Fixes #6157.
---
 src/libexpr/eval.cc  | 25 +++++++++++++------------
 src/libexpr/value.hh |  4 ++--
 src/nix/repl.cc      |  2 +-
 3 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 193358161..d9d36fab2 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -86,15 +86,10 @@ RootValue allocRootValue(Value * v)
 }
 
 
-void printValue(std::ostream & str, std::set<const Value *> & active, const Value & v)
+void printValue(std::ostream & str, std::set<const Value *> & seen, const Value & v)
 {
     checkInterrupt();
 
-    if (!active.insert(&v).second) {
-        str << "<CYCLE>";
-        return;
-    }
-
     switch (v.internalType) {
     case tInt:
         str << v.integer;
@@ -120,10 +115,14 @@ void printValue(std::ostream & str, std::set<const Value *> & active, const Valu
         str << "null";
         break;
     case tAttrs: {
+        seen.insert(&v);
         str << "{ ";
         for (auto & i : v.attrs->lexicographicOrder()) {
             str << i->name << " = ";
-            printValue(str, active, *i->value);
+            if (seen.count(i->value))
+                str << "<REPEAT>";
+            else
+                printValue(str, seen, *i->value);
             str << "; ";
         }
         str << "}";
@@ -132,9 +131,13 @@ void printValue(std::ostream & str, std::set<const Value *> & active, const Valu
     case tList1:
     case tList2:
     case tListN:
+        seen.insert(&v);
         str << "[ ";
         for (auto v2 : v.listItems()) {
-            printValue(str, active, *v2);
+            if (seen.count(v2))
+                str << "<REPEAT>";
+            else
+                printValue(str, seen, *v2);
             str << " ";
         }
         str << "]";
@@ -161,15 +164,13 @@ void printValue(std::ostream & str, std::set<const Value *> & active, const Valu
     default:
         abort();
     }
-
-    active.erase(&v);
 }
 
 
 std::ostream & operator << (std::ostream & str, const Value & v)
 {
-    std::set<const Value *> active;
-    printValue(str, active, v);
+    std::set<const Value *> seen;
+    printValue(str, seen, v);
     return str;
 }
 
diff --git a/src/libexpr/value.hh b/src/libexpr/value.hh
index 3fdff71a5..84c4d09f8 100644
--- a/src/libexpr/value.hh
+++ b/src/libexpr/value.hh
@@ -114,8 +114,8 @@ struct Value
 private:
     InternalType internalType;
 
-friend std::string showType(const Value & v);
-friend void printValue(std::ostream & str, std::set<const Value *> & active, const Value & v);
+    friend std::string showType(const Value & v);
+    friend void printValue(std::ostream & str, std::set<const Value *> & seen, const Value & v);
 
 public:
 
diff --git a/src/nix/repl.cc b/src/nix/repl.cc
index 5c0d44c68..3a51a13e6 100644
--- a/src/nix/repl.cc
+++ b/src/nix/repl.cc
@@ -800,7 +800,7 @@ std::ostream & NixRepl::printValue(std::ostream & str, Value & v, unsigned int m
                 else
                     printStringValue(str, i.first.c_str());
                 str << " = ";
-                if (seen.find(i.second) != seen.end())
+                if (seen.count(i.second))
                     str << "«repeated»";
                 else
                     try {

From e9c04c3351b4b3acae2d154b9aba808c3600054f Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 3 Mar 2022 13:29:14 +0100
Subject: [PATCH 51/52] Be more aggressive in hiding repeated values

We now memoize on Bindings / list element vectors rather than Values,
so that e.g. two Values that point to the same Bindings will be
printed only once.
---
 src/libexpr/eval.cc  | 38 +++++++++++++++++++-------------------
 src/libexpr/value.hh |  2 +-
 2 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index d9d36fab2..2d7309738 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -86,7 +86,7 @@ RootValue allocRootValue(Value * v)
 }
 
 
-void printValue(std::ostream & str, std::set<const Value *> & seen, const Value & v)
+void printValue(std::ostream & str, std::set<const void *> & seen, const Value & v)
 {
     checkInterrupt();
 
@@ -115,32 +115,32 @@ void printValue(std::ostream & str, std::set<const Value *> & seen, const Value
         str << "null";
         break;
     case tAttrs: {
-        seen.insert(&v);
-        str << "{ ";
-        for (auto & i : v.attrs->lexicographicOrder()) {
-            str << i->name << " = ";
-            if (seen.count(i->value))
-                str << "<REPEAT>";
-            else
+        if (!v.attrs->empty() && !seen.insert(v.attrs).second)
+            str << "<REPEAT>";
+        else {
+            str << "{ ";
+            for (auto & i : v.attrs->lexicographicOrder()) {
+                str << i->name << " = ";
                 printValue(str, seen, *i->value);
-            str << "; ";
+                str << "; ";
+            }
+            str << "}";
         }
-        str << "}";
         break;
     }
     case tList1:
     case tList2:
     case tListN:
-        seen.insert(&v);
-        str << "[ ";
-        for (auto v2 : v.listItems()) {
-            if (seen.count(v2))
-                str << "<REPEAT>";
-            else
+        if (v.listSize() && !seen.insert(v.listElems()).second)
+            str << "<REPEAT>";
+        else {
+            str << "[ ";
+            for (auto v2 : v.listItems()) {
                 printValue(str, seen, *v2);
-            str << " ";
+                str << " ";
+            }
+            str << "]";
         }
-        str << "]";
         break;
     case tThunk:
     case tApp:
@@ -169,7 +169,7 @@ void printValue(std::ostream & str, std::set<const Value *> & seen, const Value
 
 std::ostream & operator << (std::ostream & str, const Value & v)
 {
-    std::set<const Value *> seen;
+    std::set<const void *> seen;
     printValue(str, seen, v);
     return str;
 }
diff --git a/src/libexpr/value.hh b/src/libexpr/value.hh
index 84c4d09f8..d0fa93e92 100644
--- a/src/libexpr/value.hh
+++ b/src/libexpr/value.hh
@@ -115,7 +115,7 @@ private:
     InternalType internalType;
 
     friend std::string showType(const Value & v);
-    friend void printValue(std::ostream & str, std::set<const Value *> & seen, const Value & v);
+    friend void printValue(std::ostream & str, std::set<const void *> & seen, const Value & v);
 
 public:
 

From 6636202356b94ca4128462493770e7fedf997b0e Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 1 Mar 2022 18:31:36 +0000
Subject: [PATCH 52/52] Factor out a `GcStore` interface

Starts progress on #5729.

The idea is that we should not have these default methods throwing
"unimplemented". This is a small step in that direction.

I kept `addTempRoot` because it is a no-op, rather than failure. Also,
as a practical matter, it is called all over the place, while doing
other tasks, so the downcasting would be annoying.

Maybe in the future I could move the "real" `addTempRoot` to `GcStore`,
and the existing usecases use a `tryAddTempRoot` wrapper to downcast or
do nothing, but I wasn't sure whether that was a good idea so with a
bias to less churn I didn't do it yet.
---
 src/libmain/shared.cc                         |  1 +
 src/libstore/build/local-derivation-goal.cc   |  3 +-
 src/libstore/daemon.cc                        | 12 ++-
 src/libstore/gc-store.cc                      | 13 +++
 src/libstore/gc-store.hh                      | 84 +++++++++++++++++++
 src/libstore/local-fs-store.hh                |  3 +-
 src/libstore/local-store.hh                   |  3 +-
 src/libstore/path-with-outputs.cc             |  6 +-
 src/libstore/remote-store.cc                  |  1 +
 src/libstore/remote-store.hh                  |  3 +-
 src/libstore/store-api.hh                     | 73 ----------------
 src/libutil/tests/logging.cc                  |  2 +-
 .../nix-collect-garbage.cc                    |  4 +-
 src/nix-store/nix-store.cc                    | 18 ++--
 src/nix/store-delete.cc                       |  5 +-
 src/nix/store-gc.cc                           |  5 +-
 16 files changed, 143 insertions(+), 93 deletions(-)
 create mode 100644 src/libstore/gc-store.cc
 create mode 100644 src/libstore/gc-store.hh

diff --git a/src/libmain/shared.cc b/src/libmain/shared.cc
index a0b0f4cb3..562d1b414 100644
--- a/src/libmain/shared.cc
+++ b/src/libmain/shared.cc
@@ -1,6 +1,7 @@
 #include "globals.hh"
 #include "shared.hh"
 #include "store-api.hh"
+#include "gc-store.hh"
 #include "util.hh"
 #include "loggers.hh"
 
diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index 7e69d4145..581d63d0e 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -1,4 +1,5 @@
 #include "local-derivation-goal.hh"
+#include "gc-store.hh"
 #include "hook-instance.hh"
 #include "worker.hh"
 #include "builtins.hh"
@@ -1127,7 +1128,7 @@ struct RestrictedStoreConfig : virtual LocalFSStoreConfig
 /* A wrapper around LocalStore that only allows building/querying of
    paths that are in the input closures of the build or were added via
    recursive Nix calls. */
-struct RestrictedStore : public virtual RestrictedStoreConfig, public virtual LocalFSStore
+struct RestrictedStore : public virtual RestrictedStoreConfig, public virtual LocalFSStore, public virtual GcStore
 {
     ref<LocalStore> next;
 
diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index 9d4f6b4a4..89d9487da 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -3,6 +3,7 @@
 #include "worker-protocol.hh"
 #include "build-result.hh"
 #include "store-api.hh"
+#include "gc-store.hh"
 #include "path-with-outputs.hh"
 #include "finally.hh"
 #include "archive.hh"
@@ -623,9 +624,12 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
 
     case wopAddIndirectRoot: {
         Path path = absPath(readString(from));
+
         logger->startWork();
-        store->addIndirectRoot(path);
+        auto & gcStore = requireGcStore(*store);
+        gcStore.addIndirectRoot(path);
         logger->stopWork();
+
         to << 1;
         break;
     }
@@ -640,7 +644,8 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
 
     case wopFindRoots: {
         logger->startWork();
-        Roots roots = store->findRoots(!trusted);
+        auto & gcStore = requireGcStore(*store);
+        Roots roots = gcStore.findRoots(!trusted);
         logger->stopWork();
 
         size_t size = 0;
@@ -671,7 +676,8 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         logger->startWork();
         if (options.ignoreLiveness)
             throw Error("you are not allowed to ignore liveness");
-        store->collectGarbage(options, results);
+        auto & gcStore = requireGcStore(*store);
+        gcStore.collectGarbage(options, results);
         logger->stopWork();
 
         to << results.paths << results.bytesFreed << 0 /* obsolete */;
diff --git a/src/libstore/gc-store.cc b/src/libstore/gc-store.cc
new file mode 100644
index 000000000..3dbdec53b
--- /dev/null
+++ b/src/libstore/gc-store.cc
@@ -0,0 +1,13 @@
+#include "gc-store.hh"
+
+namespace nix {
+
+GcStore & requireGcStore(Store & store)
+{
+    auto * gcStore = dynamic_cast<GcStore *>(&store);
+    if (!gcStore)
+        throw UsageError("Garbage collection not supported by this store");
+    return *gcStore;
+}
+
+}
diff --git a/src/libstore/gc-store.hh b/src/libstore/gc-store.hh
new file mode 100644
index 000000000..829f70dc4
--- /dev/null
+++ b/src/libstore/gc-store.hh
@@ -0,0 +1,84 @@
+#pragma once
+
+#include "store-api.hh"
+
+
+namespace nix {
+
+
+typedef std::unordered_map<StorePath, std::unordered_set<std::string>> Roots;
+
+
+struct GCOptions
+{
+    /* Garbage collector operation:
+
+       - `gcReturnLive': return the set of paths reachable from
+         (i.e. in the closure of) the roots.
+
+       - `gcReturnDead': return the set of paths not reachable from
+         the roots.
+
+       - `gcDeleteDead': actually delete the latter set.
+
+       - `gcDeleteSpecific': delete the paths listed in
+          `pathsToDelete', insofar as they are not reachable.
+    */
+    typedef enum {
+        gcReturnLive,
+        gcReturnDead,
+        gcDeleteDead,
+        gcDeleteSpecific,
+    } GCAction;
+
+    GCAction action{gcDeleteDead};
+
+    /* If `ignoreLiveness' is set, then reachability from the roots is
+       ignored (dangerous!).  However, the paths must still be
+       unreferenced *within* the store (i.e., there can be no other
+       store paths that depend on them). */
+    bool ignoreLiveness{false};
+
+    /* For `gcDeleteSpecific', the paths to delete. */
+    StorePathSet pathsToDelete;
+
+    /* Stop after at least `maxFreed' bytes have been freed. */
+    uint64_t maxFreed{std::numeric_limits<uint64_t>::max()};
+};
+
+
+struct GCResults
+{
+    /* Depending on the action, the GC roots, or the paths that would
+       be or have been deleted. */
+    PathSet paths;
+
+    /* For `gcReturnDead', `gcDeleteDead' and `gcDeleteSpecific', the
+       number of bytes that would be or was freed. */
+    uint64_t bytesFreed = 0;
+};
+
+
+struct GcStore : public virtual Store
+{
+    /* Add an indirect root, which is merely a symlink to `path' from
+       /nix/var/nix/gcroots/auto/<hash of `path'>.  `path' is supposed
+       to be a symlink to a store path.  The garbage collector will
+       automatically remove the indirect root when it finds that
+       `path' has disappeared. */
+    virtual void addIndirectRoot(const Path & path) = 0;
+
+    /* Find the roots of the garbage collector.  Each root is a pair
+       (link, storepath) where `link' is the path of the symlink
+       outside of the Nix store that point to `storePath'. If
+       'censor' is true, privacy-sensitive information about roots
+       found in /proc is censored. */
+    virtual Roots findRoots(bool censor) = 0;
+
+    /* Perform a garbage collection. */
+    virtual void collectGarbage(const GCOptions & options, GCResults & results) = 0;
+};
+
+GcStore & requireGcStore(Store & store);
+
+}
diff --git a/src/libstore/local-fs-store.hh b/src/libstore/local-fs-store.hh
index d34f0cb62..fbd49dc2c 100644
--- a/src/libstore/local-fs-store.hh
+++ b/src/libstore/local-fs-store.hh
@@ -1,6 +1,7 @@
 #pragma once
 
 #include "store-api.hh"
+#include "gc-store.hh"
 
 namespace nix {
 
@@ -23,7 +24,7 @@ struct LocalFSStoreConfig : virtual StoreConfig
         "physical path to the Nix store"};
 };
 
-class LocalFSStore : public virtual LocalFSStoreConfig, public virtual Store
+class LocalFSStore : public virtual LocalFSStoreConfig, public virtual Store, virtual GcStore
 {
 public:
 
diff --git a/src/libstore/local-store.hh b/src/libstore/local-store.hh
index 1a278c9a8..70d225be3 100644
--- a/src/libstore/local-store.hh
+++ b/src/libstore/local-store.hh
@@ -5,6 +5,7 @@
 #include "pathlocks.hh"
 #include "store-api.hh"
 #include "local-fs-store.hh"
+#include "gc-store.hh"
 #include "sync.hh"
 #include "util.hh"
 
@@ -43,7 +44,7 @@ struct LocalStoreConfig : virtual LocalFSStoreConfig
 };
 
 
-class LocalStore : public virtual LocalStoreConfig, public virtual LocalFSStore
+class LocalStore : public virtual LocalStoreConfig, public virtual LocalFSStore, public virtual GcStore
 {
 private:
 
diff --git a/src/libstore/path-with-outputs.cc b/src/libstore/path-with-outputs.cc
index 97aa01b57..078c117bd 100644
--- a/src/libstore/path-with-outputs.cc
+++ b/src/libstore/path-with-outputs.cc
@@ -22,9 +22,9 @@ DerivedPath StorePathWithOutputs::toDerivedPath() const
 
 std::vector<DerivedPath> toDerivedPaths(const std::vector<StorePathWithOutputs> ss)
 {
-	std::vector<DerivedPath> reqs;
-	for (auto & s : ss) reqs.push_back(s.toDerivedPath());
-	return reqs;
+    std::vector<DerivedPath> reqs;
+    for (auto & s : ss) reqs.push_back(s.toDerivedPath());
+    return reqs;
 }
 
 
diff --git a/src/libstore/remote-store.cc b/src/libstore/remote-store.cc
index cbcb75c00..a25398ef2 100644
--- a/src/libstore/remote-store.cc
+++ b/src/libstore/remote-store.cc
@@ -1,6 +1,7 @@
 #include "serialise.hh"
 #include "util.hh"
 #include "path-with-outputs.hh"
+#include "gc-store.hh"
 #include "remote-fs-accessor.hh"
 #include "build-result.hh"
 #include "remote-store.hh"
diff --git a/src/libstore/remote-store.hh b/src/libstore/remote-store.hh
index b94216d31..2628206b1 100644
--- a/src/libstore/remote-store.hh
+++ b/src/libstore/remote-store.hh
@@ -4,6 +4,7 @@
 #include <string>
 
 #include "store-api.hh"
+#include "gc-store.hh"
 
 
 namespace nix {
@@ -29,7 +30,7 @@ struct RemoteStoreConfig : virtual StoreConfig
 
 /* FIXME: RemoteStore is a misnomer - should be something like
    DaemonStore. */
-class RemoteStore : public virtual RemoteStoreConfig, public virtual Store
+class RemoteStore : public virtual RemoteStoreConfig, public virtual Store, public virtual GcStore
 {
 public:
 
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index 8c57596d0..7bd21519c 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -76,59 +76,6 @@ enum AllowInvalidFlag : bool { DisallowInvalid = false, AllowInvalid = true };
 const uint32_t exportMagic = 0x4558494e;
 
 
-typedef std::unordered_map<StorePath, std::unordered_set<std::string>> Roots;
-
-
-struct GCOptions
-{
-    /* Garbage collector operation:
-
-       - `gcReturnLive': return the set of paths reachable from
-         (i.e. in the closure of) the roots.
-
-       - `gcReturnDead': return the set of paths not reachable from
-         the roots.
-
-       - `gcDeleteDead': actually delete the latter set.
-
-       - `gcDeleteSpecific': delete the paths listed in
-          `pathsToDelete', insofar as they are not reachable.
-    */
-    typedef enum {
-        gcReturnLive,
-        gcReturnDead,
-        gcDeleteDead,
-        gcDeleteSpecific,
-    } GCAction;
-
-    GCAction action{gcDeleteDead};
-
-    /* If `ignoreLiveness' is set, then reachability from the roots is
-       ignored (dangerous!).  However, the paths must still be
-       unreferenced *within* the store (i.e., there can be no other
-       store paths that depend on them). */
-    bool ignoreLiveness{false};
-
-    /* For `gcDeleteSpecific', the paths to delete. */
-    StorePathSet pathsToDelete;
-
-    /* Stop after at least `maxFreed' bytes have been freed. */
-    uint64_t maxFreed{std::numeric_limits<uint64_t>::max()};
-};
-
-
-struct GCResults
-{
-    /* Depending on the action, the GC roots, or the paths that would
-       be or have been deleted. */
-    PathSet paths;
-
-    /* For `gcReturnDead', `gcDeleteDead' and `gcDeleteSpecific', the
-       number of bytes that would be or was freed. */
-    uint64_t bytesFreed = 0;
-};
-
-
 enum BuildMode { bmNormal, bmRepair, bmCheck };
 
 struct BuildResult;
@@ -531,26 +478,6 @@ public:
     virtual void addTempRoot(const StorePath & path)
     { debug("not creating temporary root, store doesn't support GC"); }
 
-    /* Add an indirect root, which is merely a symlink to `path' from
-       /nix/var/nix/gcroots/auto/<hash of `path'>.  `path' is supposed
-       to be a symlink to a store path.  The garbage collector will
-       automatically remove the indirect root when it finds that
-       `path' has disappeared. */
-    virtual void addIndirectRoot(const Path & path)
-    { unsupported("addIndirectRoot"); }
-
-    /* Find the roots of the garbage collector.  Each root is a pair
-       (link, storepath) where `link' is the path of the symlink
-       outside of the Nix store that point to `storePath'. If
-       'censor' is true, privacy-sensitive information about roots
-       found in /proc is censored. */
-    virtual Roots findRoots(bool censor)
-    { unsupported("findRoots"); }
-
-    /* Perform a garbage collection. */
-    virtual void collectGarbage(const GCOptions & options, GCResults & results)
-    { unsupported("collectGarbage"); }
-
     /* Return a string representing information about the path that
        can be loaded into the database using `nix-store --load-db' or
        `nix-store --register-validity'. */
diff --git a/src/libutil/tests/logging.cc b/src/libutil/tests/logging.cc
index cef3bd481..2ffdc2e9b 100644
--- a/src/libutil/tests/logging.cc
+++ b/src/libutil/tests/logging.cc
@@ -359,7 +359,7 @@ namespace nix {
 
       // constructing without access violation.
       ErrPos ep(invalid);
-    
+
       // assignment without access violation.
       ep = invalid;
 
diff --git a/src/nix-collect-garbage/nix-collect-garbage.cc b/src/nix-collect-garbage/nix-collect-garbage.cc
index 48c030b18..4b28ea6a4 100644
--- a/src/nix-collect-garbage/nix-collect-garbage.cc
+++ b/src/nix-collect-garbage/nix-collect-garbage.cc
@@ -1,4 +1,5 @@
 #include "store-api.hh"
+#include "gc-store.hh"
 #include "profiles.hh"
 #include "shared.hh"
 #include "globals.hh"
@@ -80,10 +81,11 @@ static int main_nix_collect_garbage(int argc, char * * argv)
         // Run the actual garbage collector.
         if (!dryRun) {
             auto store = openStore();
+            auto & gcStore = requireGcStore(*store);
             options.action = GCOptions::gcDeleteDead;
             GCResults results;
             PrintFreed freed(true, results);
-            store->collectGarbage(options, results);
+            gcStore.collectGarbage(options, results);
         }
 
         return 0;
diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc
index 1ebc177f5..8ebaf9387 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@@ -3,6 +3,7 @@
 #include "dotgraph.hh"
 #include "globals.hh"
 #include "build-result.hh"
+#include "gc-store.hh"
 #include "local-store.hh"
 #include "monitor-fd.hh"
 #include "serve-protocol.hh"
@@ -428,11 +429,12 @@ static void opQuery(Strings opFlags, Strings opArgs)
             store->computeFSClosure(
                 args, referrers, true, settings.gcKeepOutputs, settings.gcKeepDerivations);
 
-            Roots roots = store->findRoots(false);
+            auto & gcStore = requireGcStore(*store);
+            Roots roots = gcStore.findRoots(false);
             for (auto & [target, links] : roots)
                 if (referrers.find(target) != referrers.end())
                     for (auto & link : links)
-                        cout << fmt("%1% -> %2%\n", link, store->printStorePath(target));
+                        cout << fmt("%1% -> %2%\n", link, gcStore.printStorePath(target));
             break;
         }
 
@@ -588,20 +590,22 @@ static void opGC(Strings opFlags, Strings opArgs)
 
     if (!opArgs.empty()) throw UsageError("no arguments expected");
 
+    auto & gcStore = requireGcStore(*store);
+
     if (printRoots) {
-        Roots roots = store->findRoots(false);
+        Roots roots = gcStore.findRoots(false);
         std::set<std::pair<Path, StorePath>> roots2;
         // Transpose and sort the roots.
         for (auto & [target, links] : roots)
             for (auto & link : links)
                 roots2.emplace(link, target);
         for (auto & [link, target] : roots2)
-            std::cout << link << " -> " << store->printStorePath(target) << "\n";
+            std::cout << link << " -> " << gcStore.printStorePath(target) << "\n";
     }
 
     else {
         PrintFreed freed(options.action == GCOptions::gcDeleteDead, results);
-        store->collectGarbage(options, results);
+        gcStore.collectGarbage(options, results);
 
         if (options.action != GCOptions::gcDeleteDead)
             for (auto & i : results.paths)
@@ -625,9 +629,11 @@ static void opDelete(Strings opFlags, Strings opArgs)
     for (auto & i : opArgs)
         options.pathsToDelete.insert(store->followLinksToStorePath(i));
 
+    auto & gcStore = requireGcStore(*store);
+
     GCResults results;
     PrintFreed freed(true, results);
-    store->collectGarbage(options, results);
+    gcStore.collectGarbage(options, results);
 }
 
 
diff --git a/src/nix/store-delete.cc b/src/nix/store-delete.cc
index e4a3cb554..aa7a8b12f 100644
--- a/src/nix/store-delete.cc
+++ b/src/nix/store-delete.cc
@@ -2,6 +2,7 @@
 #include "common-args.hh"
 #include "shared.hh"
 #include "store-api.hh"
+#include "gc-store.hh"
 
 using namespace nix;
 
@@ -32,12 +33,14 @@ struct CmdStoreDelete : StorePathsCommand
 
     void run(ref<Store> store, std::vector<StorePath> && storePaths) override
     {
+        auto & gcStore = requireGcStore(*store);
+
         for (auto & path : storePaths)
             options.pathsToDelete.insert(path);
 
         GCResults results;
         PrintFreed freed(true, results);
-        store->collectGarbage(options, results);
+        gcStore.collectGarbage(options, results);
     }
 };
 
diff --git a/src/nix/store-gc.cc b/src/nix/store-gc.cc
index a2d74066e..21718dc0c 100644
--- a/src/nix/store-gc.cc
+++ b/src/nix/store-gc.cc
@@ -2,6 +2,7 @@
 #include "common-args.hh"
 #include "shared.hh"
 #include "store-api.hh"
+#include "gc-store.hh"
 
 using namespace nix;
 
@@ -33,10 +34,12 @@ struct CmdStoreGC : StoreCommand, MixDryRun
 
     void run(ref<Store> store) override
     {
+        auto & gcStore = requireGcStore(*store);
+
         options.action = dryRun ? GCOptions::gcReturnDead : GCOptions::gcDeleteDead;
         GCResults results;
         PrintFreed freed(options.action == GCOptions::gcDeleteDead, results);
-        store->collectGarbage(options, results);
+        gcStore.collectGarbage(options, results);
     }
 };