Be stricter about checking exit codes from nix.

CHANGELOG.md

@@ -5,6 +5,9 @@
 - Fix compatibility with nix-2.3 where `nix --extra-experimental-features` isn't
   a known flag yet.  We have to switch on the version of Nix we've been given.
 
+- Stricter behaviour around invoking `nix`.  Nix returning a nonzero exit code
+  will cause nvd to abort in most cases.
+
 ## 0.2.2 (2023-05-22)
 
 - Fixed crash when `nix-store --query --references` returns nothing (e.g. for a

src/nvd

@@ -232,7 +232,8 @@ class PackageManifest:
         direct_deps_str: str = subprocess.run(
             [make_nix_bin_path("nix-store"), "--query", "--references", str(root)],
             stdout=PIPE,
-            text=True
+            text=True,
+            check=True,
         ).stdout.rstrip("\n")
 
         direct_deps: List[str] = \
@@ -445,7 +446,9 @@ def query_closure_disk_usage_bytes(target: Path) -> Optional[int]:
             + make_extra_experimental_features_args()
             + ["path-info", "--closure-size", target_str],
             stdout=PIPE,
-            text=True
+            text=True,
+            # Explicitly omitting check=True here, since this function is
+            # allowed to fail.
         ).stdout
     except FileNotFoundError:
         sys.stderr.write("nvd: Couldn't run 'nix path-info --closure-size'.\n")
@@ -533,6 +536,7 @@ def run_list(*, root, only_selected, name_patterns):
         [make_nix_bin_path("nix-store"), "-qR", str(path)],
         stdout=PIPE,
         text=True,
+        check=True,
     ).stdout.rstrip("\n").split("\n")
 
     closure_map: Dict[str, List[str]] = closure_paths_to_map(closure_paths)
@@ -592,11 +596,13 @@ def run_diff(*, root1, root2):
         [make_nix_bin_path("nix-store"), "-qR", str(left_resolved)],
         stdout=PIPE,
         text=True,
+        check=True,
     ).stdout.rstrip("\n").split("\n")
     right_closure_paths: List[str] = subprocess.run(
         [make_nix_bin_path("nix-store"), "-qR", (right_resolved)],
         stdout=PIPE,
         text=True,
+        check=True,
     ).stdout.rstrip("\n").split("\n")
 
     # Maps from pname to lists of versions.