Skip to content
Onto2DNix Derivation Identity Lab
Nix Derivation IdentityVerifying artifact

Native Nix 2.31.0 / bounded fixture / five identity regimes

Same bytes.
Different recipe.

An output can be byte-for-byte identical while the Nix derivation, dependency closure, and declared build environment remain different. Select what “the same” means and see the answer change.

Canonical resultcontent(left) = content(right)drv(left) ≠ drv(right)closure(left) ≠ closure(right)
Case identity...
Derivations...
Native inputDrvs...
Derived closure edges...
Runtime...

The useful distinction

Content answers “what did we get?” Construction answers “what exactly did we ask Nix to build?”

Use content identity for deduplication and delivery checks. Use derivation, closure, or environment identity when provenance, rebuildability, review scope, or supply-chain differences matter.

Interactive comparison

One capture, several honest answers

The controls select a frozen comparison. Native store paths and relations are never rewritten by the interface.

LEFT DERIVATION

...

...
Addressing
...
Output
...
Closure
...
Environment
...
RIGHT DERIVATION

...

...
Addressing
...
Output
...
Closure
...
Environment
...

Declared construction map

Direct input → derivation → declared output

native relationdeclared output

Only direct inputDrvs are drawn. Transitive closure is computed separately and never relabeled as native.

Output contentSAME

Left identity...

=

Right identity...

...

...

Identity matrix

The artifact does not hide disagreement

Every row evaluates the same selected pair under a different rule.

Evidence boundary

What was observed—and what was not

Nix instantiated every derivation and emitted the captured `.drv` records. Nix also materialized and inspected the fixed content object. Builders were not executed, so the input-addressed control has no observed output content.