add a per-agent nix builds mode, host or none, carried like privateUsers

swarm-controller/src/cache_miss.rs

@@ -288,13 +288,14 @@ async fn rebuild(world: &impl World, agent: &str, stored: Stored) -> Outcome {
             return Outcome::Unavailable;
         }
     };
-    let (out_path, system, cached, private_users) = match reply {
+    let (out_path, system, cached, private_users, nix_builds) = match reply {
         FromMetaReply::Built {
             out_path,
             system,
             cached,
             private_users,
-        } => (out_path, system, cached, private_users),
+            nix_builds,
+        } => (out_path, system, cached, private_users, nix_builds),
         FromMetaReply::Failed { error_tail } => {
             tracing::warn!(%agent, %meta_rev, %error_tail, "cache miss: the rebuild failed");
             return Outcome::Failed;
@@ -323,6 +324,7 @@ async fn rebuild(world: &impl World, agent: &str, stored: Stored) -> Outcome {
         built_unix: unix_now(),
         cached: true,
         private_users,
+        nix_builds,
     };
     match replace_if_current(world, agent, &now).await {
         Ok(true) => Outcome::PathChanged,
@@ -540,6 +542,8 @@ mod tests {
     use std::collections::BTreeSet;
     use std::sync::Mutex;
 
+    use hive_types::NixBuilds;
+
     use opentelemetry_sdk::metrics::data::{AggregatedMetrics, MetricData};
     use opentelemetry_sdk::metrics::{InMemoryMetricExporter, PeriodicReader};
     use tracing_subscriber::layer::SubscriberExt as _;
@@ -561,6 +565,7 @@ mod tests {
             built_unix: 7,
             cached,
             private_users: false,
+            nix_builds: NixBuilds::Host,
         }
     }
 
@@ -648,6 +653,7 @@ mod tests {
             system: "x86_64-linux".to_owned(),
             cached,
             private_users: false,
+            nix_builds: NixBuilds::Host,
         }
     }
 
@@ -893,9 +899,9 @@ mod tests {
     }
 
     /// The record a rebuild at another path writes carries what the builder
-    /// answered about the user namespace, not what the old record held.
+    /// answered about the user namespace and nix builds, not what the old record held.
     #[tokio::test]
-    async fn the_replacement_record_carries_the_rebuilds_private_users_answer() {
+    async fn the_replacement_record_carries_the_rebuilds_user_namespace_and_nix_builds_answers() {
         let other = path("iris-other");
         let FromMetaReply::Built {
             out_path,
@@ -911,12 +917,14 @@ mod tests {
             system,
             cached,
             private_users: true,
+            nix_builds: NixBuilds::Disabled,
         };
         let world = Fake::missing(&["iris"]).answering("iris", answer);
         pass_at(&world, &mut Backoff::default(), Instant::now()).await;
         let writes = world.writes();
         assert_eq!(writes.len(), 1);
         assert!(writes[0].1.private_users);
+        assert_eq!(writes[0].1.nix_builds, NixBuilds::Disabled);
     }
     #[tokio::test]
     async fn another_path_leaves_a_record_that_moved_on() {

swarm-controller/src/meta_build.rs

@@ -371,6 +371,7 @@ pub(crate) async fn run(
             system,
             cached,
             private_users,
+            nix_builds,
         }) => {
             let built_rev = meta_rev.clone();
             let closure = AgentClosure {
@@ -380,6 +381,7 @@ pub(crate) async fn run(
                 built_unix: unix_now(),
                 cached,
                 private_users,
+                nix_builds,
             };
             match queue.record(&agent, &closure).await {
                 Ok(()) => {
@@ -398,6 +400,8 @@ pub(crate) async fn run(
 mod tests {
     use std::sync::{Arc, Mutex};
 
+    use hive_types::NixBuilds;
+
     use crate::builder::runs::tests::FakeDoc;
 
     use super::*;
@@ -488,15 +492,16 @@ mod tests {
         }
 
         fn built_cached(cached: bool) -> Self {
-            Self::built_with(cached, false)
+            Self::built_with(cached, false, NixBuilds::Host)
         }
 
-        fn built_with(cached: bool, private_users: bool) -> Self {
+        fn built_with(cached: bool, private_users: bool, nix_builds: NixBuilds) -> Self {
             Self::answering(Ok(FromMetaReply::Built {
                 out_path: "/nix/store/x-toplevel".to_owned(),
                 system: "x86_64-linux".to_owned(),
                 cached,
                 private_users,
+                nix_builds,
             }))
         }
     }
@@ -627,9 +632,9 @@ mod tests {
     /// The record says what the builder said about the agent's user namespace,
     /// both ways; a builder that said nothing leaves it off.
     #[tokio::test]
-    async fn the_record_carries_the_builders_private_users_answer() {
-        for private_users in [true, false] {
-            let queue = FakeQueue::built_with(true, private_users);
+    async fn the_record_carries_the_builders_user_namespace_and_nix_builds_answers() {
+        for (private_users, nix_builds) in [(true, NixBuilds::Disabled), (false, NixBuilds::Host)] {
+            let queue = FakeQueue::built_with(true, private_users, nix_builds);
             let outcome = run_with(&FakeHead::reading(Ok(Some(REV))), &queue).await;
             assert_eq!(outcome, Outcome::Done);
             let recorded = queue.recorded.lock().unwrap();
@@ -637,6 +642,7 @@ mod tests {
                 panic!("one record: {recorded:?}")
             };
             assert_eq!(closure.private_users, private_users);
+            assert_eq!(closure.nix_builds, nix_builds);
         }
     }
 
@@ -922,6 +928,7 @@ mod tests {
             built_unix: 1,
             cached: false,
             private_users: true,
+            nix_builds: NixBuilds::Disabled,
         };
         client.record("atlas", &closure).await.expect("written");
         closure.store_path = "/nix/store/b".to_owned();