Restore input substitution

[edolstra]

Motivation

The ability to substitute inputs was removed in #10612 because it was broken: with user-specified inputs containing a narHash attribute, substitution resulted in an input that lacked the attributes returned by the real fetcher (such as lastModified). This could result in a different evaluation result, depending on whether the input was substitutable.

To fix this, we introduce a new input attribute final. If final = true, fetching the input cannot add or change any attributes.

We only attempt to substitute inputs that have final = true. This is implied by lock file entries; we only write a lock file if all its entries are "final".

The user can specified final = true in fetchTree, in which case it is their responsibility to ensure that all attributes returned by the fetcher are included in the fetchTree call. For example,

$ nix eval --impure --expr 'builtins.fetchTree { type = "github"; owner = "NixOS"; repo = "patchelf"; final = true; narHash = "sha256-FSoxTcRZMGHNJh8dNtKOkcUtjhmhU6yQXcZZfUPLhQM="; }'

succeeds in a store path with the specified NAR hash exists or is substitutable, but fails with

error: fetching final input '{"final":true,"narHash":"sha256-FSoxTcRZMGHNJh8dNtKOkcUtjhmhU6yQXcZZfUPLhQM=","owner":"NixOS","repo":"patchelf","type":"github"}' resulted in different input '{"final":true,"lastModified":1718457448,"narHash":"sha256-FSoxTcRZMGHNJh8dNtKOkcUtjhmhU6yQXcZZfUPLhQM=","owner":"NixOS","repo":"patchelf","rev":"a0f54334df36770b335c051e540ba40afcbf8378","type":"github"}'

(I.e. if you use final = true, it's possible that a build will succeed or fail depending on whether the input is substitutable, but that's better than the old situation where it could succeed with a different result.)

Context

Priorities and Process

Add :+1: to pull requests you find important.

The Nix maintainer team uses a GitHub project board to schedule and track reviews.