Nix package fails to install due to a hash mismatch

[lukash]

error: hash mismatch in fixed-output derivation '/nix/store/n7vikddbprcnbq81p160vlr4z8m3hwi8-defguard-client-pnpm-deps.drv':
         specified: sha256-48qxI+sEoLyXpCSUu1OPtDt5XgJa1ohCU40q4J91btk=
            got:    sha256-SnWvG+eUnPyjZVTW/G4hNBBJ90RqPb+wiB45gnnC9hs=
error: Cannot build '/nix/store/mvffj9jnhq09fcd0m2fjlj5pfd71fd3h-defguard-client-1.6.5.drv'.
       Reason: 1 dependency failed.
       Output paths:
         /nix/store/rlaqg3vszcgihhqjnviwgbw72vpiir5w-defguard-client-1.6.5
error: Cannot build '/nix/store/n1c3xj2bg1xd6d71iv233yv87683m5xk-system-path.drv'.
       Reason: 1 dependency failed.
       Output paths:
         /nix/store/lc5026w64cd72zbkc56d6r384ilr0vnw-system-path
error: Cannot build '/nix/store/dchv4s364dfskh81x74b1ilwzqr9sf9g-unit-defguard-service.service.drv'.
       Reason: 1 dependency failed.
       Output paths:
         /nix/store/pchfikr0yyfnda65fij3sj031ivlnld9-unit-defguard-service.service
error: Cannot build '/nix/store/w00li08f6zaq3jhh4sgygbdhr1akgk8i-nixos-system-crow-25.11.20260128.fa83fd8.drv'.
       Reason: 1 dependency failed.
       Output paths:
         /nix/store/b9aixp98qrxv9jyqmsjibm12sqnh2lvw-nixos-system-crow-25.11.20260128.fa83fd8

Seems like it's downloading some out-of-band dependencies before building which fails the input hash check? @wojcik91

[lukash]

Correct me if I'm wrong but updating the hash solves nothing. The hashes are failing for all the past packages, seems to me because the build system downloads the latest versions of some dependencies. That means the new hash will work for a couple of days on average. Updating the hash in main is not gonna help me now because I'm building from a tag and by the time I get to build the new release chances are the hash would already have changed.

[lukash]

@wojcik91 please see my previous comment. If I understand correctly, you haven't really fixed the underlying issue.

[wojcik91]

Hi @lukash.
The issue stems for the fact that while rustPlatform.importCargoLock updates the hash "automagically" based on the lockfile, but this is unfortunately not the case for fetchPnpmDeps.
This means that after we update some frontend dependencies the hash needs to be updated manually. Since the nix package is a bit of a personal side-project of mine it happens too often that it's missed. I need to find some time to setup a CI workflow to do that.

Going back to the original question - we are using a standard pnpm workflow with a workflow with a lockfile, so the dependencies and the hash doesn't change for a given commit.

Unfortunately it seems that I did run into an issue with our submodule setup, so I'll reopen this issue anyway