1 files changed, 22 insertions, 25 deletions
diff --git a/pkgs/build-support/docker/store-path-to-layer.sh b/pkgs/build-support/docker/store-path-to-layer.sh
index 7e8efeea1c10..7437da51cc4a 100755
--- a/pkgs/build-support/docker/store-path-to-layer.sh
+++ b/pkgs/build-support/docker/store-path-to-layer.sh
@@ -11,39 +11,36 @@ echo "Creating layer #$layerNumber for $@"
 mkdir -p "$layerPath"
 
 # Make sure /nix and /nix/store appear first in the archive.
+#
 # We create the directories here and use them because
 # when there are other things being added to the
 # nix store, tar could fail, saying,
 # "tar: /nix/store: file changed as we read it"
 mkdir -p nix/store
-tar -cf "$layerPath/layer.tar"  \
-    --mtime="@$SOURCE_DATE_EPOCH" \
-    --owner=0 --group=0 \
-    --transform='s,nix,/nix,' \
-    nix
-
-# We change into the /nix/store in order to avoid a similar
-# "file changed as we read it" error as above. Namely,
-# if we use the absolute path of /nix/store/123-pkg
-# and something new is added to the nix store while tar
-# is running, it will detect a change to /nix/store and
-# fail. Instead, if we cd into the nix store and copy
-# the relative nix store path, tar will ignore changes
-# to /nix/store. In order to create the correct structure
-# in the tar file, we transform the relative nix store
-# path to the absolute store path.
-for storePath in "$@"; do
-  n=$(basename "$storePath")
-  tar -C /nix/store -rpf "$layerPath/layer.tar" \
+
+# Then we change into the /nix/store in order to
+# avoid a similar "file changed as we read it" error
+# as above. Namely, if we use the absolute path of
+# /nix/store/123-pkg and something new is added to the nix
+# store while tar is running, it will detect a change to
+# /nix/store and fail. Instead, if we cd into the nix store
+# and copy the relative nix store path, tar will ignore
+# changes to /nix/store. In order to create the correct
+# structure in the tar file, we transform the relative nix
+# store path to the absolute store path.
+tarhash=$(
+  basename -a "$@" |
+    tar --create --preserve-permissions --absolute-names nix \
+      --directory /nix/store --verbatim-files-from --files-from - \
       --hard-dereference --sort=name \
       --mtime="@$SOURCE_DATE_EPOCH" \
       --owner=0 --group=0 \
-      --transform="s,$n,/nix/store/$n," \
-      $n
-done
-
-# Compute a checksum of the tarball.
-tarhash=$(tarsum < $layerPath/layer.tar)
+      --transform 's,^nix$,/\0,' \
+      --transform 's,^nix/store$,/\0,' \
+      --transform 's,^[^/],/nix/store/\0,rS' |
+    tee "$layerPath/layer.tar" |
+    tarsum
+)
 
 # Add a 'checksum' field to the JSON, with the value set to the
 # checksum of the tarball.