From 9c60c95008e2862c45d01d3d453508f644adeff6 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Tue, 10 Sep 2024 21:32:06 +0100
Subject: [PATCH] checks: make `oldBuildUsers` check fail hard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Checking for the Sequoia stuff won’t work properly if a system is
still in this old state. Best to be loud about it to deal with any
straggler systems that haven’t yet dealt with this issue.
---
 modules/system/checks.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/modules/system/checks.nix b/modules/system/checks.nix
index 1cfe1c8d..f2971c47 100644
--- a/modules/system/checks.nix
+++ b/modules/system/checks.nix
@@ -46,12 +46,17 @@ let
 
   oldBuildUsers = ''
     if dscl . -list /Users | grep -q '^nixbld'; then
-        echo "warning: Detected old style nixbld users" >&2
+        echo "error: Detected old style nixbld users, aborting activation" >&2
         echo "These can cause migration problems when upgrading to certain macOS versions" >&2
         echo "You can enable the following option to migrate to new style nixbld users" >&2
         echo >&2
         echo "    nix.configureBuildUsers = true;" >&2
         echo >&2
+        echo "or disable this check with" >&2
+        echo >&2
+        echo "    system.checks.verifyBuildUsers = false;" >&2
+        echo >&2
+        exit 2
     fi
   '';
 
@@ -260,7 +265,7 @@ in
     system.checks.text = mkMerge [
       darwinChanges
       runLink
-      oldBuildUsers
+      (mkIf (cfg.verifyBuildUsers && !config.nix.configureBuildUsers) oldBuildUsers)
       (mkIf cfg.verifyBuildUsers buildUsers)
       (mkIf (!config.nix.useDaemon) singleUser)
       nixStore