Fixes

  error: cannot create symlink '/home/eelco/Dev/nix/tests/result'; already exists

Make CA derivations compatible with recursive Nix

Add an access-control list to the realisations in recursive-nix (similar
to the already existing one for store paths), so that we can build
content-addressed derivations in the restricted store.

Fix #4353

Gracefully handle duplicate realisations

Make `nix develop` work with CA derivations

Should always hold, but that’s not necessarily obvious, so better
enforce it

Make `nix-shell` support content-addressed derivations

Recursively substitute the realisations

Fix zsh completion script

Make `computeFSClosure` ca-aware

Add a ca-derivations required machine feature

Fix the remote build of CA derivations

Track the dependencies of CA realisations

Co-authored-by: Eelco Dolstra <edolstra@gmail.com>

Rather than copying them around everywhere

Co-authored-by: Eelco Dolstra <edolstra@gmail.com>

This shouldn’t happen in practice, so better make it explicit

perlBindings: fix build on aarch64-darwin

Always send the realisations as JSON

Remove a possible existing store path when building CA derivations

Only symlink the requested outputs in `nix build`

Co-authored-by: John Ericson <git@JohnEricson.me>

Fix #4925

In case a previous interrupted build left a garbage path laying around,
remove it before trying to move the path to its final location.

Fix #4858

Make sure that the derivation we send to the remote builder is exactly
the one that we want to build locally so that the output ids are exactly
the same

Fix #4845

UDSRemoteStore: Support the 'root' store parameter

Useful when we're using a daemon with a chroot store, e.g.

  $ NIX_DAEMON_SOCKET_PATH=/tmp/chroot/nix/var/nix/daemon-socket/socket nix-daemon --store /tmp/chroot

Then the client can now connect with

  $ nix build --store unix:///tmp/chroot/nix/var/nix/daemon-socket/socket?root=/tmp/chroot nixpkgs#hello

Also add a small architecture to easily run CA-enabled tests

When recursive Nix is enabled, NIX_REMOTE is set to
unix:///build/.nix-socket, which doesn't work outside of the sandbox.