stdenv: assert that env is an attrset

doc/release-notes/rl-2511.section.md

@@ -27,6 +27,8 @@
 
 - `gnome-keyring` no longer ships with an SSH agent anymore because it has been deprecated upstream. You should use `gcr_4` instead, which provides the same features. More information on why this was done can be found on [the relevant GCR upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67).
 
+- `stdenv.mkDerivation` and other derivation builders that use it no longer allow the value of `env` to be anything but an attribute set, for the purpose of setting environment variables that are available to the [builder](https://nix.dev/manual/nix/latest/store/derivation/#builder) process. An environment variable called `env` can still be provided by means of `mkDerivation { env.env = ...; }`, though we recommend to use a more specific name than "env".
+
 - `conftest` since `0.60.0` has moved to use rego `v1` as default. To continue using `v0` use `--rego-version v0`. For more information about upgrading to Rego v1 syntax, see the [upstream docs](https://www.openpolicyagent.org/docs/latest/v0-upgrade/).
 
 - `tooling-language-server` has been renamed to `deputy` (both the package and binary), following the rename of the upstream project.

pkgs/by-name/ev/evil-winrm/package.nix

@@ -6,7 +6,14 @@
   bundlerEnv,
   bundlerUpdateScript,
 }:
-
+let
+  rubyEnv = bundlerEnv {
+    name = "evil-winrm";
+    gemfile = ./Gemfile;
+    lockfile = ./Gemfile.lock;
+    gemset = ./gemset.nix;
+  };
+in
 stdenv.mkDerivation rec {
   pname = "evil-winrm";
   version = "3.5";
@@ -18,19 +25,12 @@ stdenv.mkDerivation rec {
     hash = "sha256-8Lyo7BgypzrHMEcbYlxo/XWwOtBqs2tczYnc3+XEbeA=";
   };
 
-  env = bundlerEnv {
-    name = pname;
-    gemfile = ./Gemfile;
-    lockfile = ./Gemfile.lock;
-    gemset = ./gemset.nix;
-  };
-
   nativeBuildInputs = [
     makeWrapper
   ];
 
   buildInputs = [
-    env.wrappedRuby
+    rubyEnv.wrappedRuby
   ];
 
   installPhase = ''

pkgs/by-name/gh/ghi/package.nix

@@ -6,29 +6,30 @@
   bundlerEnv,
   tree,
 }:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "ghi";
+let
   version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "drazisil";
     repo = "ghi";
-    rev = "refs/tags/${finalAttrs.version}";
+    tag = version;
     hash = "sha256-3V1lxI4VhP0jC3VSWyNS327gOCKowbbLB6ae1idpFFI=";
   };
 
-  env = bundlerEnv {
+  rubyEnv = bundlerEnv {
     name = "ghi";
-
-    gemfile = "${finalAttrs.src}/Gemfile";
-    lockfile = "${finalAttrs.src}/Gemfile.lock";
+    gemfile = "${src}/Gemfile";
+    lockfile = "${src}/Gemfile.lock";
     gemset = ./gemset.nix;
   };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ghi";
+  inherit version src;
 
   nativeBuildInputs = [ makeWrapper ];
 
-  buildInputs = [ finalAttrs.env.wrappedRuby ];
+  buildInputs = [ rubyEnv.wrappedRuby ];
 
   installPhase = ''
     mkdir -p $out/bin

pkgs/by-name/js/jsduck/package.nix

@@ -5,26 +5,26 @@
   makeWrapper,
   bundlerUpdateScript,
 }:
-
-stdenv.mkDerivation rec {
-  pname = "jsduck";
-  version = (import ./gemset.nix).jsduck.version;
-
-  env = bundlerEnv {
-    name = pname;
+let
+  rubyEnv = bundlerEnv {
+    name = "jsduck";
     gemfile = ./Gemfile;
     lockfile = ./Gemfile.lock;
     gemset = ./gemset.nix;
   };
+in
+stdenv.mkDerivation {
+  pname = "jsduck";
+  version = (import ./gemset.nix).jsduck.version;
 
   dontUnpack = true;
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ env ];
+  buildInputs = [ rubyEnv ];
 
   installPhase = ''
     mkdir -p $out/bin
-    makeWrapper ${env}/bin/jsduck $out/bin/jsduck
+    makeWrapper ${rubyEnv}/bin/jsduck $out/bin/jsduck
   '';
 
   passthru.updateScript = bundlerUpdateScript "jsduck";

pkgs/by-name/ro/ronn/package.nix

@@ -7,15 +7,15 @@
   groff,
   callPackage,
 }:
-
-stdenv.mkDerivation rec {
-  pname = "ronn";
-  version = env.gems.ronn-ng.version;
-
-  env = bundlerEnv {
+let
+  rubyEnv = bundlerEnv {
     name = "ronn-gems";
     gemdir = ./.;
   };
+in
+stdenv.mkDerivation {
+  pname = "ronn";
+  version = rubyEnv.gems.ronn-ng.version;
 
   dontUnpack = true;
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     runHook preInstall
 
     mkdir -p $out/bin
-    makeWrapper ${env}/bin/ronn $out/bin/ronn \
+    makeWrapper ${rubyEnv}/bin/ronn $out/bin/ronn \
       --set PATH ${groff}/bin
 
     runHook postInstall
@@ -46,6 +46,6 @@ stdenv.mkDerivation rec {
       zimbatm
       nicknovitski
     ];
-    platforms = env.ruby.meta.platforms;
+    platforms = rubyEnv.ruby.meta.platforms;
   };
 }

pkgs/stdenv/generic/make-derivation.nix

@@ -748,18 +748,15 @@ let
     let
       mainProgram = meta.mainProgram or null;
       env' = env // lib.optionalAttrs (mainProgram != null) { NIX_MAIN_PROGRAM = mainProgram; };
-      envIsExportable = isAttrs env' && !isDerivation env';
 
       derivationArg = makeDerivationArgument (
-        removeAttrs attrs (
-          [
-            "meta"
-            "passthru"
-            "pos"
-          ]
-          ++ optional (__structuredAttrs || envIsExportable) "env"
-        )
-        // optionalAttrs __structuredAttrs { env = checkedEnv; }
+        removeAttrs attrs ([
+          "meta"
+          "passthru"
+          "pos"
+          "env"
+        ])
+        // lib.optionalAttrs __structuredAttrs { env = checkedEnv; }
         // {
           cmakeFlags = makeCMakeFlags attrs;
           mesonFlags = makeMesonFlags attrs;
@@ -787,8 +784,8 @@ let
               }";
           errors = lib.concatMapStringsSep "\n" makeError overlappingNames;
         in
-        assert assertMsg envIsExportable
-          "When using structured attributes, `env` must be an attribute set of environment variables.";
+        assert assertMsg (isAttrs env && !isDerivation env)
+          "`env` must be an attribute set of environment variables. Set `env.env` or pick a more specific name.";
         assert assertMsg (overlappingNames == [ ])
           "The `env` attribute set cannot contain any attributes passed to derivation. The following attributes are overlapping:\n${errors}";
         mapAttrs (
@@ -882,7 +879,7 @@ let
         # should be made available to Nix expressions using the
         # derivation (e.g., in assertions).
         passthru
-    ) (derivation (derivationArg // optionalAttrs envIsExportable checkedEnv));
+    ) (derivation (derivationArg // checkedEnv));
 
 in
 {

pkgs/test/stdenv/default.nix

@@ -258,25 +258,6 @@ in
     stdenv' = bootStdenv;
   };
 
-  # Test compatibility with derivations using `env` as a regular variable.
-  test-env-derivation = bootStdenv.mkDerivation rec {
-    name = "test-env-derivation";
-    env = bootStdenv.mkDerivation {
-      name = "foo";
-      buildCommand = ''
-        mkdir "$out"
-        touch "$out/bar"
-      '';
-    };
-
-    passAsFile = [ "buildCommand" ];
-    buildCommand = ''
-      declare -p env
-      [[ $env == "${env}" ]]
-      touch "$out"
-    '';
-  };
-
   # Check that mkDerivation rejects MD5 hashes
   rejectedHashes = lib.recurseIntoAttrs {
     md5 =