A closure query that includes only derivations that affect the output hash of the argument

[roberth]

Is your feature request related to a problem? Please describe.

How do I know which derivations would cause a rebuild of my derivation, if any of them were to change.

We currently have nix-store -q (or similar) queries for the closure on:

• all derivation to derivation dependencies (as well as the inputSrcs, but grep -E '.drv$' works, thanks to a restriction on derivation names)
  • returns too much, not accounting for FODs
• dependencies that occur in the outputs (nix-store -q --requisites $(nix-store -q --outputs foo.drv))
  • returns too little, and is about output paths, not derivations

We don't have a closure that's suitable for determining which derivations are relevant for rebuilds. Notably, changes behind a fixed output are masked. For example:

nix-repl> (pkgs.writeText "hi" "${pkgs.hello.src.overrideAttrs { }}").outPath
"/nix/store/98wswxzf7r4l45iy3n2rick1g4mkcvxd-hi"

nix-repl> (pkgs.writeText "hi" "${pkgs.hello.src.overrideAttrs { invalidate = "yes"; }}").outPath
"/nix/store/98wswxzf7r4l45iy3n2rick1g4mkcvxd-hi"

This leads to some confusion about what things need to be rebuilt, as one may assume that the output has is dependent on the drvPath hash, which it is not.

Describe the solution you'd like

nix-store -q --rebuild-closure or something.

Describe alternatives you've considered

Can't think of any. Providing this exact data seems to be squarely a responsibility that Nix should meet. Scripting this seems infeasible.

Additional context

Apparent confusion about rebuilds after the xz trojan long thread - probably not too much relevant info in there; just a use case: how do I know which derivations cause my derivation to rebuild, if they were to be changed?

Priorities

Add 👍 to issues you find important.