flake.lock and reproducibility

What Is flake.lock?#

The first time you run nix build or nixos-rebuild switch, Nix uses the URL in flake.nix, such as github:nixos/nixpkgs/nixos-unstable, to fetch the repository's latest Commit ID from GitHub. These specific Commit IDs and their corresponding hashes are recorded in a JSON file: flake.lock.

Why Is It So Important?#

1. Strong Reproducibility

With the traditional nix-channel workflow, two machines running nix-channel --update at different times may download different package versions. With Flakes: as long as flake.lock stays unchanged, dependency sources can remain consistent for the same platform and configuration. Final outputs still depend on the platform, build determinism, availability of external resources, and impure evaluation.

2. A Powerful Collaboration Tool

If you push your NixOS configuration to GitHub, others can clone it and build with the same dependency versions. Hardware configuration, platform differences, and machine state still need to be handled individually.

Manage the Lock File#

1. Update Dependencies

• Update everything: nix flake update This refreshes all dependencies to the latest Commit in their respective repositories.
• Update a specific dependency: nix flake update nixpkgs This updates only nixpkgs.

2. Inspect the Locked State

Open flake.lock, which is human-readable JSON:

"nixpkgs": {
  "locked": {
    "lastModified": 1712048532,
    "narHash": "sha256-...",
    "rev": "5ac7...",
    "type": "github"
  }
}

• rev: the specific Git Commit ID. This is the core of the lock.

Practical Advice: Commit It to Git#

You must commit flake.lock to your Git repository. It is an integral part of your system configuration.