nix-required-mounts: support deep symlinks; refactor & test

[tfc]

I have been running cuda apps on both NVIDIA and AMD (with ZLUDA) graphics cards and found that nix-required-mounts produced some problems:

• created paths that don't exist
• infinite looping
• extremely slow execution because there were too many paths (N*N complexity instead of N buried somewhere)

While fixing these issues, i decided that the scenario is complex enough for test cases, so i wrote those and restructured the app a bit to make it more testable.

Tested these changes again on two NVIDIA and AMD machines, works very nicely.

Fixes #497824

CC @SomeoneSerge @ConnorBaker @kmein @jfly

Things done

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.

[kmein]

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 500971
Commit: 67747fd2b7659d6fe4dcd7dde694c53b392518a1

---

x86_64-linux

✅ 2 packages built:

• nix-required-mounts
• nix-required-mounts.dist

[kmein]

Functionality-wise, everything looks really good. I've left a few inline comments throughout the patch—mostly just some naming questions and minor nitpicks around type hints and a small optimization.

Let me know what you think of those, but overall this is in great shape!

[tfc]

TODO:

• i will add a testcase that proves why we need to resolve symlink parents
• split up "paths" into "paths" and "storepaths" so we don't do the recursion needlessly on nix store paths whose closure has long been pre-calculated already. maybe next PR

[SomeoneSerge]

This is still a git mv. With py_modules in pyproject.toml it should be fine to just keep the top-level module

[tfc]

on the one hand there is the git mv, on the other hand it's much more ergonomic during development to have all files that belong to the actual tool without the extra stuff in one folder. Especially because you don't have to explain black, mypy, and pytest, which files to ignore.

I understand preserving blame history is useful, but is it more useful than tool ergonomy while maintaining the app?

[SomeoneSerge]

If this somehow affects ergonomics in your environment, there is something off about your environment. Top-level modules are perfectly normal and should not cause any issues.

[SomeoneSerge]

Can you please clarify your request to me or is this only a comment?

Not a blocker

…

On 7 April 2026 06:59:25 UTC, Jacek Galowicz ***@***.***> wrote: @tfc commented on this pull request. > + assert ss( + discover_reachable_paths( + [root / "c", root / "f"], follow_symlinks=True + ) + ) == ss( + # fmt: off Can you please clarify your request to me or is this only a comment?

[tfc]

@SomeoneSerge

• pushed the latest change request
• squashed all commits (don't panic if you were not through yet, i parked the unsquashed changes on another branch if you want that back for your convenience)
• added you as co-author in the commit message

[SomeoneSerge]

I'd say

1. ...: fix paths -> something like ...: mount symlink children's targets & add tests

   Breaking change: instead of expanding a single symlink chain,
   unsafeFollowSymlinks now walks directories recursively and
   mounts all symlink descendants' targets.
   This accommodates usecases like:
   /sys/dev/char/226:128 -> ../../devices/pci0000:00/0000:00:02.0/drm/renderD128
   /sys/dev/char/226:128/subsystem -> ../../../../../class/drm
   

2. Undo git mv

And we're done.

[tfc]

@SomeoneSerge done

[tfc]

ok there are pipeline errors because i used lib.fileset to filter everything that does not belong to the app and its tests. As the error message suggests, instead of filtering the app should go into a subfolder.

As the app has only been touched 3 times in the last 2 years i would rather drop the git history and go back to the subfolder. This way, the closure .py and .nix files and everything else does not become part of the package closure.

Please advise.

[SomeoneSerge]

RE: fileset

Wow this warning is ludicrous, fileset has been the primary and default method for defining this kind of src for 1+ years.

EDIT: So one more "nix doesn't vfs" issue, breaking a documented nixpkgs functionality...

[SomeoneSerge]

@tfc I can't deny I'm partially motivated by spite, but I want this to be lib.sources then (which uses relative paths; lib.sources.sourceFilesBySuffices or lib.sources.sourceByRegex), so far as the github action isn't reverted.

[tfc]

@SomeoneSerge understandable. done.

[SomeoneSerge]

Thank you @tfc, @kmein, @jfly! I know this has taken quite a bit longer and more friction than you aimed for... That said, I liked and learned a lot from all the discussions, and appreciate the thought you've put into this