`ca-derivations` input placeholder does not start with `storeDir`

[roberth]

Describe the bug

Do ca-derivations input (downstream) placeholders need to of the format /[a-z0-9]{52}?
The current behavior leads to bugs in code that is not aware of this behavior (e.g. NixOS/nixpkgs#261512), and even when the code is fixed, this placeholder is incomprehensible when it leaks out in e.g. thrown errors in the Nix language.

This wasn't always the case: 3a7b330

Steps To Reproduce

Expected behavior

A placeholder contains the storeDir and name, so that relevant info about the placeholder can be understood by code and humans.

If there's a store layer benefit, we could even handle this at the language level, but changing the store layer to work with store path-like placeholders seems like a simpler and more complete solution.

Metadata

Additional context

• minimal install cd.iso can't be built with nixpkgs.config.contentAddressedByDefault = true; nixpkgs#261512
  • lib/types.nix: allow CA paths in pathInStore nixpkgs#377007
• Similar issue: ca-derivations breaks some nix-side store paths manipulations #4764

Checklist

• checked latest Nix manual (source)
• checked open bug issues and pull requests for possible duplicates

---

Add 👍 to issues you find important.

[mschwaig]

It would make sense to me if instead of /0k24dfvijqra5pjhd1xhkg467fvh33cllgsxvpyklyhzymrm13xb they had a format like

${/nix/store/w14fhgwzx0421c2ry4d9hx1cpsfsjlf5-bootstrap-tools.drv^out}

Note the template syntax to indicate to the user that this is not meant verbatim, but as a reference that gets resolved to its contents.

[mschwaig]

The following thought is quite far out there, but it is somehow quite important to me that you could theoretically also express the concept of an analogous placeholder in a similar manner, not to describe the unresolved version of a CA derivation, but to describe the resolved version of an IA derivation, even if resolved versions of IA derivations, or ways to validate them more strictly to satisfy constraints like that do not exist yet, and maybe never will.

${pathHashesTo(/nix/store/razasrvdg7ckplfmvdxv4ia3wbayr94s-bootstrap-tools, r:sha256:1w0h112a6l4qhkfiw4wg9gv5j3ysjchmxrf385l06xajaryawz9r)}

[timschumi]

${/nix/store/w14fhgwzx0421c2ry4d9hx1cpsfsjlf5-bootstrap-tools.drv^out}

Drive-by comment because I'm not really deep into the topic, but existing code may already assume that the name of the derivation can be suffix-matched (e.g. here).