Private flake usage in devenv.yaml has issues related to caching in the /nix/store

[jboyens]

Describe the bug
This is a very interesting bug that I believe digs down into some lowlevel incompatibilities / assumptions.

Scenario:

Background:

• You are on a development team that utilizes a number of private Git repositories for code
• You create an application for use internally who's repo acts is a flake
• You create a releases repository that references released versions of applications.
  • The releases repository is intended for use downstream as inputs into devenv.yaml files for others.

Specific instance:

• You release a new version of your internal application
• You devenv up in the downstream repositories.
• You verify that the new devenv correctly works and you see the new version of your application.
• You commit the devenv.lock and announce the release
• Several coworkers complain that your release process did not work and the devenv is broken

Specific Error Message

       at «nix-internal»/call-flake.nix:39:13:

           38|     builtins.mapAttrs
           39|       (key: node:
             |             ^
           40|         let

       … while calling anonymous lambda

       error: getting status of '/nix/store/qd3i5ak8y7wqi5cm9ra66i8nhfazywkg-source/flake.nix': No such file or directory

Looking for this source dir in the nix store shows you that this dir does not exist.

Digging deeper you find that while you've specified your flake url in devenv.yaml like this:

url: git+ssh://[email protected]/owner/repo

There seems to be an issue in pulling that repo as you see that there is an error early on in the devenv output (prior to the nix trace):

fatal: couldn't find remote ref refs/heads/<<tip of the private 'releases' repo SHA>>

But git doesn't store individual revs as refs in refs/heads!

Possibly related issues

• Prevent fetchGit from using incorrect cached rev for different refs NixOS/nix#7174
• Nix 2.4 assumes refs are branch names and fails on tags (regression) NixOS/nix#5291

Workarounds
As a workaround, if your colleagues check out the releases repo, let devenv run on the releases repo (devenv shell, cd releases), the correct rev will be cached and evaluation will succeed.

To reproduce

1. Create a devenv.yaml
2. include a private flake (spec. a git+ssh://... URL that requires SSH auth to pull)
3. reference a package from that private flake
4. Receive error message about "no such file or directory" (so long as you do not have a current cached version already in the nix store)

Version

devenv: 0.6.3 x86_64-linux (both release version and current main branch versions)

[jboyens]

I do realize how incredibly niche this one seems, but I've been unable to find an effective work-around short of the above referenced workaround.

It seems like there may be some missing glue here on devenv's part to make sure that as it translates devenv.yaml to a flake definition that it correctly specifies the input so that Nix has the best possible data to be successful.

I have not yet been able to dig deep enough into devenv's layers to understand where that glue might go.