builders.basic: Validate environment variable names

tidepool/src/lib/types.nix

@@ -2,11 +2,43 @@
 let
   inherit (config) lib;
 
+  # Essentially black-listed environment variable names
+  #
+  # This is just a list of attributes based into builtins.derivation in
+  # tidepool/src/builders/foundation/basic.nix
+  #
+  # Please keep it in sync
+  reservedVars = [
+    "name"
+    "script"
+    "system"
+    "script"
+    "env"
+    "__structuredAttrs"
+    "SHELL"
+    "builder"
+    "args"
+  ];
+
+  # str -> bool
+  notReservedVar = name: !(builtins.elem name reservedVars);
+
   pretty = lib.generators.pretty { };
 in
 {
   config = {
     lib.types = {
+      # When passed-down to Bash, paths and derivations are just strings.
+      bashString =
+        (lib.types.one [
+          lib.types.string
+          lib.types.path
+          lib.types.derivation
+        ])
+        // {
+          name = "BashString";
+          description = "A Bash-compatible string";
+        };
       license =
         let
           type = lib.types.submodule (
@@ -754,8 +786,14 @@ in
                 };
 
                 env = lib.options.create {
-                  description = "The environment for the package.";
-                  type = lib.types.attrs.of lib.types.string;
+                  description = "Environment variables in the derivation";
+                  type = lib.types.withCheck (lib.types.attrs.of lib.types.bashString) (
+                    # TODO: Better errors, these suck right now.
+                    lib.fp.pipe [
+                      builtins.attrNames
+                      (builtins.all notReservedVar)
+                    ]
+                  );
                   default.value = { };
                 };