flake.lock resolution differs in some cases between 2.25 and 2.26

[getchoo]

Describe the bug

When using Nix 2.26, nix deems lockfile changes necessary for my Flake, even though they aren't when using Nix 2.25

Steps To Reproduce

1. Clone https://github.com/getchoo-contrib/nix-2-26-lock-repro (specifically getchoo-contrib/nix-2-26-lock-repro@a40c1b7)
2. Enter a shell with Nix 2.25 via nix shell github:NixOS/nix/2.25.5
3. Run nix flake archive
4. Enter a shell with Nix 2.26 via nix shell github:NixOS/nix/2.26.1
5. Run nix flake archive again

Here's how it ran on my machine (plus a few sanity checks for demonstration)

$ git status
HEAD detached at a40c1b7
nothing to commit, working tree clean
$ nix --version
nix (Nix) 2.25.5
$ nix flake archive
$ git status
HEAD detached at a40c1b7
nothing to commit, working tree clean
$ nix shell github:NixOS/nix/2.26.1
$ nix --version
nix (Nix) 2.26.1
$ nix flake archive
warning: updating lock file '"/home/seth/repos/nix-2-26-lock-repro/flake.lock"':
• Updated input 'determinate/determinate-nixd-aarch64-darwin':
    'https://install.determinate.systems/determinate-nixd/tag/v0.3.0/macOS?narHash=sha256-yLy38fgeC%2BorxYylwUwLUuRUdgi9WLEflLX9j9NDIUI%3D'
  → 'https://install.determinate.systems/determinate-nixd/tag/v0.3.1/macOS?narHash=sha256-IsrNz0s63v3CZK1Qy3b3309gfiTRugDgRmjuKhwzpp4%3D'
• Updated input 'determinate/determinate-nixd-aarch64-linux':
    'https://install.determinate.systems/determinate-nixd/tag/v0.3.0/aarch64-linux?narHash=sha256-9/HjI0v/ZLoTqOy%2B5%2BviIQh8iGjf49qMLRVthVZ3V9U%3D'
  → 'https://install.determinate.systems/determinate-nixd/tag/v0.3.1/aarch64-linux?narHash=sha256-A7vdjMh5GirMmtmV5fha03oV1%2BuFn/sVG6HX7/9Jav0%3D'
• Updated input 'determinate/determinate-nixd-x86_64-linux':
    'https://install.determinate.systems/determinate-nixd/tag/v0.3.0/x86_64-linux?narHash=sha256-cyvqGm%2BWT5l3N40wSO6FSJTm7Lxm9w1owpXjAYtGAm4%3D'
  → 'https://install.determinate.systems/determinate-nixd/tag/v0.3.1/x86_64-linux?narHash=sha256-HI3yzhqjRvuG0VXnrDUG3W13ztrDTcQDqHht6SgLcpQ%3D'
$ git status
HEAD detached at a40c1b7
Changes not staged for commit:
  (use "git add <file>..." to update what will be committed)
  (use "git restore <file>..." to discard changes in working directory)
        modified:   flake.lock

no changes added to commit (use "git add" and/or "git commit -a")
$ git restore flake.lock
$ exit
$ nix --version
nix (Nix) 2.25.5
$ nix flake archive
$ git status
HEAD detached at a40c1b7
nothing to commit, working tree clean

Expected behavior

Lockfile resolution is consistent across both versions

Metadata

Nix 2.25 version:

$ nix-env --version
nix-env (Nix) 2.25.5

Nix 2.26 version:

$ nix-env --version
nix-env (Nix) 2.26.1

Additional context

This was originally found in https://github.com/getchoo/borealis, where my auto-update workflow ran with Nix 2.26 from https://github.com/DeterminateSystems/nix-installer-action and ended up pushing the change demonstrated above as getchoo/borealis@7cf9edf. I only realized what was going on since (thankfully) I was making other CI changes and I came across inconsistent behavior in subsequent runs

Some other things I noticed while trying to get a good repro for this (that I hope will help!) are:

• The problematic (root) input of https://github.com/DeterminateSystems/determinate recently updated it's determinate-nixd inputs that are changed as a result of this discrepancy
• The determinate-nixd inputs are not Flakes and use flake = false
• The "original" URL of the determinate input as recorded in flake.lock (https://flakehub.com/f/DeterminateSystems/determinate/0.1.tar.gz) resolves to the latest version (as intended) with the previously mentioned determinate-nixd updates
• Passing --no-update-lock-file when using Nix 2.26 produces it's standard <flake> requires lock file changes but they're not allowed due to '--no-update-lock-file' error message
• This issue doesn't happen when pinning the determinate input by it's GitHub repository with github:DeterminateSystems/determinate/a51f3446e6a798765dd1f47a018717b181938dbc
• This issue doesn't happen when pinning the determinate input through FlakeHub with https://flakehub.com/f/DeterminateSystems/determinate/=0.1.178.tar.gz
• This issue doesn't happen in a local checkout of the https://github.com/DeterminateSystems/determinate repository itself

My best guess is that Nix 2.26 may be peaking into (at least some of) the inputs of tarball Flakes through their "original" URL instead of the "resolved" equivalent -- especially since this behavior isn't triggered when you ensure the immutable HTTP URL returned by the former is consistent, like in the last 3 points above

Checklist

• checked latest Nix manual (source)
• checked open bug issues and pull requests for possible duplicates

---

Add 👍 to issues you find important.

[edolstra]

Thanks for the report!

My best guess is that Nix 2.26 may be peaking into (at least some of) the inputs of tarball Flakes through their "original" URL instead of the "resolved" equivalent

Yeah, that's exactly what was happening.