generates derivations with invalid 'out' path (missing /nix/store/ prefix) using ca derivations

[schickling]

Description

When using devenv 1.11.2 with Determinate Nix 3.15.0, devenv-nix generates derivations with malformed out paths that are missing the /nix/store/ prefix.

Error Message

error:
       … while checking derivation '/nix/store/v8viwrvdzswiwqi7ww7glshi9yl9w3vb-devenv-shell-env.drv'

       error:
       error: derivation has incorrect environment variable 'out', should be '/nix/store/xm5r7mnqlcwsam4c9zb9210nlr0w8cas-devenv-shell-env' but is actually '/1rz4g4znpzjwh1xymhjpm42vipw92pr73vdgl6xs1hycac8kf2n9'

Root Cause

Inspecting the generated derivation shows the out field is malformed:

("out","/1rz4g4znpzjwh1xymhjpm42vipw92pr73vdgl6xs1hycac8kf2n9")

This is missing the /nix/store/ prefix. The correct value should be:

("out","/nix/store/xm5r7mnqlcwsam4c9zb9210nlr0w8cas-devenv-shell-env")

Environment

• devenv version: 1.11.2 (aarch64-darwin)
• devenv-nix version: 2.30.4 (bundled with devenv)
• System Nix: Determinate Nix 3.15.0 / nix 2.33.0
• OS: macOS (Darwin 25.2.0, aarch64)

Reproduction

1. Create a new devenv project with a simple devenv.nix:

{ pkgs, ... }:
{
  languages.javascript = {
    enable = true;
    package = pkgs.nodejs_24;
    corepack.enable = true;
  };

  packages = [
    pkgs.nodejs_24
    pkgs.bun
  ];
}

2. Create devenv.yaml:

inputs:
  nixpkgs:
    url: github:NixOS/nixpkgs/nixos-unstable

3. Run devenv shell or direnv allow

4. Observe the error about incorrect out environment variable

Notes

• Projects with pre-existing cached profiles (built before this bug) continue to work
• The issue appears to be in devenv-nix's content-addressed derivation handling when interacting with Determinate Nix
• Clearing all caches (.devenv/, devenv.lock, ~/.cache/nix/eval-cache-v*) does not resolve the issue
• The same malformed derivation hash is regenerated each time

Workaround

None found. Projects with existing cached profiles continue to work, but new projects cannot build their initial shell.

[schickling]

Confirmed Reproduction

Tested in a clean /tmp directory:

cd /tmp
mkdir devenv-test-repro && cd devenv-test-repro

cat > devenv.nix << 'NIXEOF'
{ pkgs, ... }:
{
  languages.javascript = {
    enable = true;
    package = pkgs.nodejs_24;
    corepack.enable = true;
  };

  packages = [
    pkgs.nodejs_24
    pkgs.bun
  ];
}
NIXEOF

cat > devenv.yaml << 'YAMLEOF'
inputs:
  nixpkgs:
    url: github:NixOS/nixpkgs/nixos-unstable
YAMLEOF

devenv shell -- echo "works"

Result:

error: derivation has incorrect environment variable 'out', should be '/nix/store/jnvrpziq3vswdf8p8v3a3gr71sicd5pq-devenv-shell-env' but is actually '/1rz4g4znpzjwh1xymhjpm42vipw92pr73vdgl6xs1hycac8kf2n9'

Note the malformed out path is always the same hash (/1rz4g4znpzjwh1xymhjpm42vipw92pr73vdgl6xs1hycac8kf2n9) regardless of project, suggesting a systematic issue in how devenv-nix generates content-addressed derivations.

[domenkozar]

I'd guess this must be a bug in Determinate Nix 3.15.0 / nix 2.33.0, as the code for generating derivations lies in the daemon/system part.

[sandydoo]

The issue appears to be in devenv-nix's content-addressed derivation handling when interacting with Determinate Nix

@schickling does this issue only happen when content-addressed derivations are enabled or is it more general?

[schickling]

Yes, this issue only occurs when ca-derivations is enabled.

My system has extra-experimental-features = impure-derivations ca-derivations in /etc/nix/nix.custom.conf (set by Determinate Nix installer).

The error shows the out path being set to just a hash (/1rz4g4znpzjwh1xymhjpm42vipw92pr73vdgl6xs1hycac8kf2n9) instead of the full store path (/nix/store/...-devenv-shell-env).

This appears related to upstream Nix issues:

• NixOS/nix#5309 - "nix-shell sets seemingly incorrect `$out` value" for CA derivations
• NixOS/nix#12361 - "ca-derivations input placeholder does not start with storeDir"

Workaround: Removing ca-derivations from the experimental features resolves the issue.

---

Posted by Claude Code on behalf of @schickling

[schickling]

Sorry, accidentally closed.