While we were talking I updated lemmy-server using overrideAttrs for my own use. It’s honestly not that hard. You change the commit, specify some random incorrect hashes, build it, nix screams at you that the hash is incorrect (and generously provides the correct one), put the correct hash, and build again. Done.
The hash isn’t there for security, it’s to make sure the code you’re building against doesn’t randomly change which could make the derivation fail to compile.
For example, for the source, you can specify a literal HTTP download from a URL, and that file could be changed by the host at any given time, so it’s there as a safeguard.
Nixpkgs is by nature fully reproducible and declarative - that means you can’t write a nix package to just build from master branch. You also have to specify the sha256 hash to absolutely make sure the source is the same for everyone.
With flakes, it’s a bit easier, because if the package you’re trying to build has a flake, you can just update it in your own lockfile and it will be rebuilt from the latest version.
If using something from nixpkgs, you have to wait (or PR yourself) for someone to PR the update, or you can also use overrideAttrs to do a “private” fix.
For example, I’m using the wlsunset program, but wanted to build from a different branch, so I did this:
In the end, the lag is just caused by the fact that it has to work. You never want to get some broken version that you want to avoid, so nix packages are always tested with the new versions, because it may turn out they may need some patching for that version, or they have some new dependencies.
Is this sort of lag the nature of package managers that will inherently be part of NixOS and nixpk?
While we were talking I updated lemmy-server using
overrideAttrsfor my own use. It’s honestly not that hard. You change the commit, specify some random incorrect hashes, build it, nix screams at you that the hash is incorrect (and generously provides the correct one), put the correct hash, and build again. Done.That kinda defeats the purpose of the hash.
The hash isn’t there for security, it’s to make sure the code you’re building against doesn’t randomly change which could make the derivation fail to compile. For example, for the source, you can specify a literal HTTP download from a URL, and that file could be changed by the host at any given time, so it’s there as a safeguard.
Nixpkgs is by nature fully reproducible and declarative - that means you can’t write a nix package to just build from master branch. You also have to specify the sha256 hash to absolutely make sure the source is the same for everyone.
With flakes, it’s a bit easier, because if the package you’re trying to build has a flake, you can just update it in your own lockfile and it will be rebuilt from the latest version.
If using something from nixpkgs, you have to wait (or PR yourself) for someone to PR the update, or you can also use overrideAttrs to do a “private” fix.
For example, I’m using the
wlsunsetprogram, but wanted to build from a different branch, so I did this:This just changes the source attribute to another commit and another sha hash, and it works fine.
In the end, the lag is just caused by the fact that it has to work. You never want to get some broken version that you want to avoid, so nix packages are always tested with the new versions, because it may turn out they may need some patching for that version, or they have some new dependencies.