[remove nixpkgs] Remove CAPath, and only enable for nix >= 2.17

[savil]

Summary

We want to restrict the feature to nix 2.17+, because it enables pure mode nix
when using just fromPath in builtins.fetchClosure.

This greatly simplifies the devbox.lock issues with caPath, and will improve the UX.

This Remove Nixpkgs feature is most beneficial to new users who have not downloaded the nixpkgs they need. These users are most likely to have the latest nix installed for them, so I think restricting to nix >= 2.17 is an acceptable tradeoff.

How was it tested?

did a sanity test on x86-darwin.
need to test better on a "supported system" where nix >= 2.17:

• updated Devbox Cloud to run nix 2.17
• in examples/development/python/pip, did devbox shell. Since we have system-info for python and not pip, the generated flake.nix looked like this:

{
   description = "A devbox shell";

   inputs = {
     nixpkgs.url = "http://lax.devbox-nixed.internal/nixos/nixpkgs/archive/8670e496ffd093b60e74e7fa53526aa5920d09eb.tar.gz";
     nixpkgs-8670e4.url = "http://lax.devbox-nixed.internal/nixos/nixpkgs/archive/8670e496ffd093b60e74e7fa53526aa5920d09eb.tar.gz";
   };

   outputs = {
     self,
     nixpkgs,
     nixpkgs-8670e4,
   }:
      let
        pkgs = nixpkgs.legacyPackages.x86_64-linux;
        nixpkgs-8670e4-pkgs = (import nixpkgs-8670e4 {
          system = "x86_64-linux";
          config.allowUnfree = true;
          config.permittedInsecurePackages = [
          ];
        });
      in
      {
        devShells.x86_64-linux.default = pkgs.mkShell {
          buildInputs = [
            (builtins.fetchClosure{
              fromStore = "https://cache.nixos.org";
              fromPath = "/nix/store/95cxzy2hpizr23343b8bskl4yacf4b3l-python3-3.10.11";
              inputAddressed = true;
            })
            nixpkgs-8670e4-pkgs.python310Packages.pip
          ];
        };
      };
 }

[savil]

Current dependencies on/for this PR:

• main
  • PR [remove nixpkgs] Remove CAPath, and only enable for nix >= 2.17 #1332 👈

This comment was auto-generated by Graphite.

[savil]

Moving to draft. From testing this on devbox-cloud with nix 2.17, I see some errors that need fixing.

[mikeland73]

nice!

[mikeland73]

Can we cache this output? In a package level variable is probably fine.