The article reveals that Nix's sandbox-paths configuration is a hidden input to derivations that isn't captured in the derivation hash, potentially breaking reproducibility. The author demonstrates this with a practical example where the presence or absence of /truth in the sandbox changes the build output, yet the derivation hash remains identical.
Background
Nix is a functional package manager and build system that achieves reproducibility through content-addressed store paths. The sandbox restricts what files a build can access, but its configuration is not part of the derivation hash by default.
- Source
- Lobsters
- Published
- Aug 4, 2026 at 09:02 PM
- Score
- 6.0 / 10