writeScript - $PATH inheritance issue

[oneingan]

I recently discovered that the operable script in your library is not as pure as expected because it inherits the $PATH from the running system. While this is not problematic in a minimal container, I encountered an issue when conducting integration tests for the operable layer. Running the script standalone revealed this potential bug.

You can find the relevant code here:

std/src/lib/ops/writeScript.nix

Line 39 in 4e20f55

export PATH="${l.makeBinPath runtimeInputs}:$PATH"

Do you consider this a bug that should be addressed to ensure the script's path purity?

[nrdxp]

@blaggacao was the original author here iirc. Do you perhaps remember why you did this? Was it intentional?

[whs-dot-hk]

Hi, I think it is good, because the base image can be any docker e.g. alpine (the binary from base image can be use)

[blaggacao]

We could consider this a bug on the grounds of your reasoning, yes.

I don't actually think that this had been a conscientious decision to inherit the environment's PATH.

Happy to merge a patch.

the binary from base image can be use

The operable was designed to be as close to a complete runtime just short of being an OCI image or having a special root mount, so that it can run in any environment / root mount.

So in terms of runtime dependencies, they should be brought with it.