While the Nix store is almost always at `/nix/store`, we shouldn't
assume it to be. Checking only the trailing part of the link is less
exact but removes this bad assumption.
I also added a check for the symlink's contents when overwriting it to
more accurately check whether we own it and should replace it.
This PR supercedes #226.
So far application bundles were always linked to `~/Applications` or
`~/Applications/Nix Apps` if the former was an existing directory.
In nix-community/home-manager#1341 a conflict was found with suggested
new Home Manager behavior, where applications installed through Home
Manager would end up in `~/Applications/Home Manager Apps`. This was in
an attempt to make them discoverable through Spotlight but further
investigation suggest Spotlight does not pick up symlinked apps (details
in the issue).
However, there are other programs that expect to be able to write to
`~/Applications` so taking over the directory is unfortunate.
PR #226 dropped linking `~/Applications` and instead made sure the
directory exists so we can always link in `~/Applications/Nix Apps`.
After further discussion in #macos:nixos.org we came to the conclusion
that we shouldn't link applications to a user directory at all. Since we
manage packages for multiple users, application bundles should go in
`/Applications`.
Because previous code will likely leave a symlink at
`~/Applications/{,Nix Apps}`, which will become dangling once the path
it links to is garbage collected from the store we test to see if a link
exists and it conforms to the path we're expecting and if it does remove
it.
Programs like Steam add applications to ~/Applications and such.
This commit disables linking ~/Applications to nix-darwin Applications
in the /nix/store and makes nix-darwin use a subfolder within
~/Applications.
According to some investigation creating "role" accounts avoids
migration problems when upgrading to certain macOS versions, so create
the build users to match that definition and remove the old ones if
present.
Role accounts require name starting with _ and UID in 200-400 range
