stdenv: make meta.position overridable

[l0b0]

Rebase of orphaned #295973, since the original can't be merged as-is. Original description:

this is done simply by changing the order in which attrsets are merged with //

fixes #295907

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[l0b0]

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 359191

---

x86_64-linux

[emilazy]

Has the inherit meta; footgun discussed in #295973 (comment) been addressed?

[pbsds]

since Mic92/nix-update#267 it has become of somewhat lower importance to get right w.r.t. nix-update, but nix-search will be affected and i have not checked nixpkgs-update

[pbsds]

Perhaps we need to support meta.position = lib.mkForce "some value"?

[l0b0]

@emilazy @pbsds I rebased the original branch with the assumption that it was ready to merge except for the conflict, since it already had two approvals. My only motivation was to do what looked like a small amount of work to finish something others had spent effort on and seemed to care about. So I'm afraid I don't have enough context for your comments. Would either of you be willing to take over, or to ELI5 what's needed to push this over the line?

[pbsds]

The problem is that meta.position will become too easy to override by mistake. For example the common pattern meta = foobar-unwrapped.meta // { homepage = xyz; } or inherit (foobar-unwrapped) meta will inherit the position of foobar-unwrapped.

Only allowing to override the meta.position when explicitly intended would be a way to solve this. Whether we want to opt into this by wrapping the position value (e.g. meta.position = lib.mkForce ...) or with a flag (e.g. meta.__enableOverridePosition = true) can be discussed. I lean towards the latter.