Only activate derivation-meta when __meta is an object

Author: roberth

src/libstore/derivation-options.cc

@@ -378,15 +378,15 @@ DerivationOptions<SingleDerivedPath> derivationOptionsFromStructuredAttrs(
             getStringSetAttr(env, parsed, "requiredSystemFeatures").value_or(defaults.requiredSystemFeatures),
         .preferLocalBuild = getBoolAttr(env, parsed, "preferLocalBuild", defaults.preferLocalBuild),
         .allowSubstitutes = getBoolAttr(env, parsed, "allowSubstitutes", defaults.allowSubstitutes),
-        .meta = [&]() -> std::optional<nlohmann::json> {
+        .meta = [&]() -> std::optional<nlohmann::json::object_t> {
             if (!parsed)
                 return std::nullopt;
 
             auto & structuredAttrs = parsed->structuredAttrs;
 
             // Only extract __meta if derivation-meta feature is used
             if (hasDerivationMetaFeature(structuredAttrs)) {
-                return structuredAttrs.at("__meta");
+                return getObject(structuredAttrs.at("__meta"));
             }
             return std::nullopt;
         }(),
@@ -628,12 +628,7 @@ DerivationOptions<SingleDerivedPath> adl_serializer<DerivationOptions<SingleDeri
         .requiredSystemFeatures = getStringSet(valueAt(json, "requiredSystemFeatures")),
         .preferLocalBuild = getBoolean(valueAt(json, "preferLocalBuild")),
         .allowSubstitutes = getBoolean(valueAt(json, "allowSubstitutes")),
-        .meta = [&]() -> std::optional<nlohmann::json> {
-            if (auto * metaPtr = optionalValueAt(json, "meta"))
-                if (auto * nonNullMeta = getNullable(*metaPtr))
-                    return *nonNullMeta;
-            return std::nullopt;
-        }(),
+        .meta = valueAt(json, "meta").get<std::optional<nlohmann::json::object_t>>(),
     };
 }
 
@@ -668,10 +663,7 @@ void adl_serializer<DerivationOptions<SingleDerivedPath>>::to_json(
     json["requiredSystemFeatures"] = o.requiredSystemFeatures;
     json["preferLocalBuild"] = o.preferLocalBuild;
     json["allowSubstitutes"] = o.allowSubstitutes;
-    if (o.meta)
-        json["meta"] = *o.meta;
-    else
-        json["meta"] = nullptr;
+    json["meta"] = o.meta;
 }
 
 OutputChecks<SingleDerivedPath> adl_serializer<OutputChecks<SingleDerivedPath>>::from_json(const json & json_)

src/libstore/derivations.cc

@@ -891,7 +891,12 @@ static const DrvHash pathDerivationModulo(Store & store, const StorePath & drvPa
 
 bool hasDerivationMetaFeature(const nlohmann::json::object_t & structuredAttrs)
 {
-    if (!structuredAttrs.contains("__meta"))
+    auto metaIt = structuredAttrs.find("__meta");
+    if (metaIt == structuredAttrs.end())
+        return false;
+
+    // Validate that __meta is an object
+    if (!metaIt->second.is_object())
         return false;
 
     if (auto it = structuredAttrs.find("requiredSystemFeatures");

src/libstore/include/nix/store/derivation-options.hh

@@ -180,8 +180,10 @@ struct DerivationOptions
      * Metadata excluded from hash computation. Only populated when both
      * `__meta` and `derivation-meta` system feature are present.
      * Otherwise `__meta` remains in structured attributes as a regular attribute.
+     *
+     * Must be a JSON object (not a string, array, or other JSON type).
      */
-    std::optional<nlohmann::json> meta;
+    std::optional<nlohmann::json::object_t> meta;
 
     bool operator==(const DerivationOptions &) const = default;