From c5557e80db6b143ff7f6bff308398ff526b2a908 Mon Sep 17 00:00:00 2001
From: Scott Worley <scottworley@scottworley.com>
Date: Mon, 19 Jul 2021 14:29:43 -0700
Subject: [PATCH] Fail if the build happens locally

This test is supposed to exercise fetching from a remote trusted cache,
so a local build means that this didn't happen.
---
 checks/one-publisher.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/checks/one-publisher.nix b/checks/one-publisher.nix
index 7ecec8f..b661624 100644
--- a/checks/one-publisher.nix
+++ b/checks/one-publisher.nix
@@ -51,6 +51,10 @@ let
     }
   '';
 
+  log-local-builds = writeShellScript "log-local-builds" ''
+    echo "$OUT_PATHS" >> /var/log/local-builds
+  '';
+
   clientConfig = writeText "clientConfig" ''
     { lib, ... }: {
       services.trustix-nix-cache = {
@@ -76,7 +80,9 @@ let
           percentage.minimum = 66;
         };
       };
-
+      nix.extraOptions = '''
+        post-build-hook = ${log-local-builds}
+      ''';
     }
   '';
 
@@ -176,5 +182,6 @@ in nixosTest {
         "nixos-rebuild switch --show-trace",
     )
     clint.succeed("nix-build '<nixpkgs>' -A hello")
+    clint.fail("grep hello /var/log/local-builds")
   '';
 }
-- 
2.44.1