From 3751c06fe199f22249c4fbbe01382641ee87687b Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 6 Feb 2025 22:08:48 +0100
Subject: [PATCH 01/30] coerceToStorePath(): Improve error message

---
 src/libexpr/eval.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 19ca1a359..38dd7425b 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -2441,7 +2441,7 @@ StorePath EvalState::coerceToStorePath(const PosIdx pos, Value & v, NixStringCon
     auto path = coerceToString(pos, v, context, errorCtx, false, false, true).toOwned();
     if (auto storePath = store->maybeParseStorePath(path))
         return *storePath;
-    error<EvalError>("path '%1%' is not in the Nix store", path).withTrace(pos, errorCtx).debugThrow();
+    error<EvalError>("cannoet coerce '%s' to a store path because it's not in the Nix store", path).withTrace(pos, errorCtx).debugThrow();
 }
 
 

From f24ff056cb36c3ceb887722c44db64b705371dae Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 6 Feb 2025 22:39:01 +0100
Subject: [PATCH 02/30] Make `nix flake metadata|update|lock` lazy

These don't need to evaluate anything (except for the flake metadata
in flake.nix) so we can make these commands operate on lazy trees
without risk of any semantic change in the evaluator.

However, `nix flake metadata` now no longer prints the store path,
which is a breaking change (but unavoidable if we want lazy trees).
---
 src/libflake/flake/flake.cc       | 38 +++++++++++++++++++------------
 src/libflake/flake/flake.hh       | 11 ++++++++-
 src/nix/flake.cc                  | 10 +++-----
 tests/functional/flakes/flakes.sh |  1 -
 4 files changed, 37 insertions(+), 23 deletions(-)

diff --git a/src/libflake/flake/flake.cc b/src/libflake/flake/flake.cc
index 717848ee1..90945f949 100644
--- a/src/libflake/flake/flake.cc
+++ b/src/libflake/flake/flake.cc
@@ -397,7 +397,8 @@ static Flake getFlake(
     const FlakeRef & originalRef,
     bool useRegistries,
     FlakeCache & flakeCache,
-    const InputAttrPath & lockRootAttrPath)
+    const InputAttrPath & lockRootAttrPath,
+    bool forceLazy)
 {
     // Fetch a lazy tree first.
     auto [accessor, resolvedRef, lockedRef] = fetchOrSubstituteTree(
@@ -419,17 +420,22 @@ static Flake getFlake(
         lockedRef = lockedRef2;
     }
 
-    // Copy the tree to the store.
-    auto storePath = copyInputToStore(state, lockedRef.input, originalRef.input, accessor);
-
     // Re-parse flake.nix from the store.
-    return readFlake(state, originalRef, resolvedRef, lockedRef, state.rootPath(state.store->toRealPath(storePath)), lockRootAttrPath);
+    return readFlake(
+        state, originalRef, resolvedRef, lockedRef,
+        forceLazy && lockedRef.input.isLocked()
+        ? SourcePath(accessor)
+        : // Copy the tree to the store.
+          state.rootPath(
+            state.store->toRealPath(
+                copyInputToStore(state, lockedRef.input, originalRef.input, accessor))),
+        lockRootAttrPath);
 }
 
-Flake getFlake(EvalState & state, const FlakeRef & originalRef, bool useRegistries)
+Flake getFlake(EvalState & state, const FlakeRef & originalRef, bool useRegistries, bool forceLazy)
 {
     FlakeCache flakeCache;
-    return getFlake(state, originalRef, useRegistries, flakeCache, {});
+    return getFlake(state, originalRef, useRegistries, flakeCache, {}, forceLazy);
 }
 
 static LockFile readLockFile(
@@ -455,7 +461,7 @@ LockedFlake lockFlake(
 
     auto useRegistries = lockFlags.useRegistries.value_or(settings.useRegistries);
 
-    auto flake = getFlake(state, topRef, useRegistries, flakeCache, {});
+    auto flake = getFlake(state, topRef, useRegistries, flakeCache, {}, lockFlags.forceLazy);
 
     if (lockFlags.applyNixConfig) {
         flake.config.apply(settings);
@@ -630,7 +636,7 @@ LockedFlake lockFlake(
                         if (auto resolvedPath = resolveRelativePath()) {
                             return readFlake(state, *input.ref, *input.ref, *input.ref, *resolvedPath, inputAttrPath);
                         } else {
-                            return getFlake(state, *input.ref, useRegistries, flakeCache, inputAttrPath);
+                            return getFlake(state, *input.ref, useRegistries, flakeCache, inputAttrPath, lockFlags.forceLazy);
                         }
                     };
 
@@ -781,10 +787,14 @@ LockedFlake lockFlake(
                                     auto [accessor, resolvedRef, lockedRef] = fetchOrSubstituteTree(
                                         state, *input.ref, useRegistries, flakeCache);
 
-                                    // FIXME: allow input to be lazy.
-                                    auto storePath = copyInputToStore(state, lockedRef.input, input.ref->input, accessor);
-
-                                    return {state.rootPath(state.store->toRealPath(storePath)), lockedRef};
+                                    return {
+                                        lockFlags.forceLazy && lockedRef.input.isLocked()
+                                        ? SourcePath(accessor)
+                                        : state.rootPath(
+                                            state.store->toRealPath(
+                                                copyInputToStore(state, lockedRef.input, input.ref->input, accessor))),
+                                        lockedRef
+                                    };
                                 }
                             }();
 
@@ -894,7 +904,7 @@ LockedFlake lockFlake(
                            repo, so we should re-read it. FIXME: we could
                            also just clear the 'rev' field... */
                         auto prevLockedRef = flake.lockedRef;
-                        flake = getFlake(state, topRef, useRegistries);
+                        flake = getFlake(state, topRef, useRegistries, lockFlags.forceLazy);
 
                         if (lockFlags.commitLockFile &&
                             flake.lockedRef.input.getRev() &&
diff --git a/src/libflake/flake/flake.hh b/src/libflake/flake/flake.hh
index 8d9b9a698..3696fd110 100644
--- a/src/libflake/flake/flake.hh
+++ b/src/libflake/flake/flake.hh
@@ -123,7 +123,11 @@ struct Flake
     }
 };
 
-Flake getFlake(EvalState & state, const FlakeRef & flakeRef, bool useRegistries);
+Flake getFlake(
+    EvalState & state,
+    const FlakeRef & flakeRef,
+    bool useRegistries,
+    bool forceLazy = false);
 
 /**
  * Fingerprint of a locked flake; used as a cache key.
@@ -221,6 +225,11 @@ struct LockFlags
      * for those inputs will be ignored.
      */
     std::set<InputAttrPath> inputUpdates;
+
+    /**
+     * If set, do not copy the flake to the Nix store.
+     */
+    bool forceLazy = false;
 };
 
 LockedFlake lockFlake(
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 6f220b495..1cc13bf59 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -133,6 +133,7 @@ public:
         lockFlags.recreateLockFile = updateAll;
         lockFlags.writeLockFile = true;
         lockFlags.applyNixConfig = true;
+        lockFlags.forceLazy = true;
 
         lockFlake();
     }
@@ -165,6 +166,7 @@ struct CmdFlakeLock : FlakeCommand
         lockFlags.writeLockFile = true;
         lockFlags.failOnUnlocked = true;
         lockFlags.applyNixConfig = true;
+        lockFlags.forceLazy = true;
 
         lockFlake();
     }
@@ -211,12 +213,10 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
 
     void run(nix::ref<nix::Store> store) override
     {
+        lockFlags.forceLazy = true;
         auto lockedFlake = lockFlake();
         auto & flake = lockedFlake.flake;
 
-        // Currently, all flakes are in the Nix store via the rootFS accessor.
-        auto storePath = store->printStorePath(sourcePathToStorePath(store, flake.path).first);
-
         if (json) {
             nlohmann::json j;
             if (flake.description)
@@ -237,7 +237,6 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
                 j["revCount"] = *revCount;
             if (auto lastModified = flake.lockedRef.input.getLastModified())
                 j["lastModified"] = *lastModified;
-            j["path"] = storePath;
             j["locks"] = lockedFlake.lockFile.toJSON().first;
             if (auto fingerprint = lockedFlake.getFingerprint(store, fetchSettings))
                 j["fingerprint"] = fingerprint->to_string(HashFormat::Base16, false);
@@ -254,9 +253,6 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
                 logger->cout(
                     ANSI_BOLD "Description:" ANSI_NORMAL "   %s",
                     *flake.description);
-            logger->cout(
-                ANSI_BOLD "Path:" ANSI_NORMAL "          %s",
-                storePath);
             if (auto rev = flake.lockedRef.input.getRev())
                 logger->cout(
                     ANSI_BOLD "Revision:" ANSI_NORMAL "      %s",
diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
index d8c9f254d..8936afa22 100755
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -69,7 +69,6 @@ nix flake metadata "$flake1Dir" | grepQuiet 'URL:.*flake1.*'
 # Test 'nix flake metadata --json'.
 json=$(nix flake metadata flake1 --json | jq .)
 [[ $(echo "$json" | jq -r .description) = 'Bla bla' ]]
-[[ -d $(echo "$json" | jq -r .path) ]]
 [[ $(echo "$json" | jq -r .lastModified) = $(git -C "$flake1Dir" log -n1 --format=%ct) ]]
 hash1=$(echo "$json" | jq -r .revision)
 [[ -n $(echo "$json" | jq -r .fingerprint) ]]

From 9e6b89c92c00c67ada5ea6f15b48b8f6c69b002b Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 7 Feb 2025 14:58:22 +0100
Subject: [PATCH 03/30] lockFlake(): Always compute a NAR hash for inputs

For the top-level flake, we don't need a NAR hash. But for inputs, we
do.

Also, add a test for the lazy behaviour of `nix flake metadata|lock`.
---
 src/libflake/flake/flake.cc                  | 51 ++++++++++++--------
 src/libflake/flake/flake.hh                  | 13 ++++-
 src/libstore/store-api.cc                    |  8 ++-
 src/nix/flake.cc                             | 16 ++++--
 tests/functional/flakes/flakes.sh            |  2 +-
 tests/functional/flakes/follow-paths.sh      |  9 ++--
 tests/functional/flakes/unlocked-override.sh |  2 +-
 7 files changed, 69 insertions(+), 32 deletions(-)

diff --git a/src/libflake/flake/flake.cc b/src/libflake/flake/flake.cc
index 90945f949..a0ba404cd 100644
--- a/src/libflake/flake/flake.cc
+++ b/src/libflake/flake/flake.cc
@@ -100,6 +100,20 @@ static StorePath copyInputToStore(
     return storePath;
 }
 
+static SourcePath maybeCopyInputToStore(
+    EvalState & state,
+    fetchers::Input & input,
+    const fetchers::Input & originalInput,
+    ref<SourceAccessor> accessor,
+    CopyMode copyMode)
+{
+    return copyMode == CopyMode::Lazy || (copyMode == CopyMode::RequireLockable && (input.isLocked() || input.getNarHash()))
+        ? SourcePath(accessor)
+        : state.rootPath(
+            state.store->toRealPath(
+                copyInputToStore(state, input, originalInput, accessor)));
+}
+
 static void forceTrivialValue(EvalState & state, Value & value, const PosIdx pos)
 {
     if (value.isThunk() && value.isTrivial())
@@ -398,7 +412,7 @@ static Flake getFlake(
     bool useRegistries,
     FlakeCache & flakeCache,
     const InputAttrPath & lockRootAttrPath,
-    bool forceLazy)
+    CopyMode copyMode)
 {
     // Fetch a lazy tree first.
     auto [accessor, resolvedRef, lockedRef] = fetchOrSubstituteTree(
@@ -423,19 +437,14 @@ static Flake getFlake(
     // Re-parse flake.nix from the store.
     return readFlake(
         state, originalRef, resolvedRef, lockedRef,
-        forceLazy && lockedRef.input.isLocked()
-        ? SourcePath(accessor)
-        : // Copy the tree to the store.
-          state.rootPath(
-            state.store->toRealPath(
-                copyInputToStore(state, lockedRef.input, originalRef.input, accessor))),
+        maybeCopyInputToStore(state, lockedRef.input, originalRef.input, accessor, copyMode),
         lockRootAttrPath);
 }
 
-Flake getFlake(EvalState & state, const FlakeRef & originalRef, bool useRegistries, bool forceLazy)
+Flake getFlake(EvalState & state, const FlakeRef & originalRef, bool useRegistries, CopyMode copyMode)
 {
     FlakeCache flakeCache;
-    return getFlake(state, originalRef, useRegistries, flakeCache, {}, forceLazy);
+    return getFlake(state, originalRef, useRegistries, flakeCache, {}, copyMode);
 }
 
 static LockFile readLockFile(
@@ -461,7 +470,7 @@ LockedFlake lockFlake(
 
     auto useRegistries = lockFlags.useRegistries.value_or(settings.useRegistries);
 
-    auto flake = getFlake(state, topRef, useRegistries, flakeCache, {}, lockFlags.forceLazy);
+    auto flake = getFlake(state, topRef, useRegistries, flakeCache, {}, lockFlags.copyMode);
 
     if (lockFlags.applyNixConfig) {
         flake.config.apply(settings);
@@ -506,6 +515,13 @@ LockedFlake lockFlake(
             explicitCliOverrides.insert(i.first);
         }
 
+        /* For locking of inputs, we require at least a NAR
+           hash. I.e. we can't be fully lazy. */
+        auto inputCopyMode =
+            lockFlags.copyMode == CopyMode::Lazy
+            ? CopyMode::RequireLockable
+            : lockFlags.copyMode;
+
         LockFile newLockFile;
 
         std::vector<FlakeRef> parents;
@@ -633,11 +649,10 @@ LockedFlake lockFlake(
                        flakerefs relative to the parent flake. */
                     auto getInputFlake = [&]()
                     {
-                        if (auto resolvedPath = resolveRelativePath()) {
+                        if (auto resolvedPath = resolveRelativePath())
                             return readFlake(state, *input.ref, *input.ref, *input.ref, *resolvedPath, inputAttrPath);
-                        } else {
-                            return getFlake(state, *input.ref, useRegistries, flakeCache, inputAttrPath, lockFlags.forceLazy);
-                        }
+                        else
+                            return getFlake(state, *input.ref, useRegistries, flakeCache, inputAttrPath, inputCopyMode);
                     };
 
                     /* Do we have an entry in the existing lock file?
@@ -788,11 +803,7 @@ LockedFlake lockFlake(
                                         state, *input.ref, useRegistries, flakeCache);
 
                                     return {
-                                        lockFlags.forceLazy && lockedRef.input.isLocked()
-                                        ? SourcePath(accessor)
-                                        : state.rootPath(
-                                            state.store->toRealPath(
-                                                copyInputToStore(state, lockedRef.input, input.ref->input, accessor))),
+                                        maybeCopyInputToStore(state, lockedRef.input, input.ref->input, accessor, inputCopyMode),
                                         lockedRef
                                     };
                                 }
@@ -904,7 +915,7 @@ LockedFlake lockFlake(
                            repo, so we should re-read it. FIXME: we could
                            also just clear the 'rev' field... */
                         auto prevLockedRef = flake.lockedRef;
-                        flake = getFlake(state, topRef, useRegistries, lockFlags.forceLazy);
+                        flake = getFlake(state, topRef, useRegistries, lockFlags.copyMode);
 
                         if (lockFlags.commitLockFile &&
                             flake.lockedRef.input.getRev() &&
diff --git a/src/libflake/flake/flake.hh b/src/libflake/flake/flake.hh
index 3696fd110..93bd18188 100644
--- a/src/libflake/flake/flake.hh
+++ b/src/libflake/flake/flake.hh
@@ -123,11 +123,20 @@ struct Flake
     }
 };
 
+enum struct CopyMode {
+    //! Copy the input to the store.
+    RequireStorePath,
+    //! Ensure that the input is locked or has a NAR hash.
+    RequireLockable,
+    //! Just return a lazy source accessor.
+    Lazy,
+};
+
 Flake getFlake(
     EvalState & state,
     const FlakeRef & flakeRef,
     bool useRegistries,
-    bool forceLazy = false);
+    CopyMode copyMode = CopyMode::RequireStorePath);
 
 /**
  * Fingerprint of a locked flake; used as a cache key.
@@ -229,7 +238,7 @@ struct LockFlags
     /**
      * If set, do not copy the flake to the Nix store.
      */
-    bool forceLazy = false;
+    CopyMode copyMode = CopyMode::RequireStorePath;
 };
 
 LockedFlake lockFlake(
diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index 236622eae..25acdefc8 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -214,8 +214,12 @@ StorePath Store::addToStore(
     auto sink = sourceToSink([&](Source & source) {
         LengthSource lengthSource(source);
         storePath = addToStoreFromDump(lengthSource, name, fsm, method, hashAlgo, references, repair);
-        if (settings.warnLargePathThreshold && lengthSource.total >= settings.warnLargePathThreshold)
-            warn("copied large path '%s' to the store (%s)", path, renderSize(lengthSource.total));
+        if (settings.warnLargePathThreshold && lengthSource.total >= settings.warnLargePathThreshold) {
+            static bool failOnLargePath = getEnv("_NIX_TEST_FAIL_ON_LARGE_PATH").value_or("") == "1";
+            if (failOnLargePath)
+                throw Error("won't copy large path '%s' to the store (%d)", path, renderSize(lengthSource.total));
+            warn("copied large path '%s' to the store (%d)", path, renderSize(lengthSource.total));
+        }
     });
     dumpPath(path, *sink, fsm, filter);
     sink->finish();
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 1cc13bf59..37df51f37 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -133,7 +133,7 @@ public:
         lockFlags.recreateLockFile = updateAll;
         lockFlags.writeLockFile = true;
         lockFlags.applyNixConfig = true;
-        lockFlags.forceLazy = true;
+        lockFlags.copyMode = CopyMode::Lazy;
 
         lockFlake();
     }
@@ -166,7 +166,7 @@ struct CmdFlakeLock : FlakeCommand
         lockFlags.writeLockFile = true;
         lockFlags.failOnUnlocked = true;
         lockFlags.applyNixConfig = true;
-        lockFlags.forceLazy = true;
+        lockFlags.copyMode = CopyMode::Lazy;
 
         lockFlake();
     }
@@ -213,10 +213,14 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
 
     void run(nix::ref<nix::Store> store) override
     {
-        lockFlags.forceLazy = true;
+        lockFlags.copyMode = CopyMode::Lazy;
         auto lockedFlake = lockFlake();
         auto & flake = lockedFlake.flake;
 
+        std::optional<StorePath> storePath;
+        if (flake.lockedRef.input.getNarHash())
+            storePath = flake.lockedRef.input.computeStorePath(*store);
+
         if (json) {
             nlohmann::json j;
             if (flake.description)
@@ -237,6 +241,8 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
                 j["revCount"] = *revCount;
             if (auto lastModified = flake.lockedRef.input.getLastModified())
                 j["lastModified"] = *lastModified;
+            if (storePath)
+                j["path"] = store->printStorePath(*storePath);
             j["locks"] = lockedFlake.lockFile.toJSON().first;
             if (auto fingerprint = lockedFlake.getFingerprint(store, fetchSettings))
                 j["fingerprint"] = fingerprint->to_string(HashFormat::Base16, false);
@@ -253,6 +259,10 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
                 logger->cout(
                     ANSI_BOLD "Description:" ANSI_NORMAL "   %s",
                     *flake.description);
+            if (storePath)
+                logger->cout(
+                    ANSI_BOLD "Path:" ANSI_NORMAL "          %s",
+                    store->printStorePath(*storePath));
             if (auto rev = flake.lockedRef.input.getRev())
                 logger->cout(
                     ANSI_BOLD "Revision:" ANSI_NORMAL "      %s",
diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
index 8936afa22..f55d3a04d 100755
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -75,7 +75,7 @@ hash1=$(echo "$json" | jq -r .revision)
 
 echo foo > "$flake1Dir/foo"
 git -C "$flake1Dir" add $flake1Dir/foo
-[[ $(nix flake metadata flake1 --json --refresh | jq -r .dirtyRevision) == "$hash1-dirty" ]]
+[[ $(_NIX_TEST_FAIL_ON_LARGE_PATH=1 nix flake metadata flake1 --json --refresh --warn-large-path-threshold 1 | jq -r .dirtyRevision) == "$hash1-dirty" ]]
 [[ "$(nix flake metadata flake1 --json | jq -r .fingerprint)" != null ]]
 
 echo -n '# foo' >> "$flake1Dir/flake.nix"
diff --git a/tests/functional/flakes/follow-paths.sh b/tests/functional/flakes/follow-paths.sh
index a71d4c6d7..c654e0650 100755
--- a/tests/functional/flakes/follow-paths.sh
+++ b/tests/functional/flakes/follow-paths.sh
@@ -118,20 +118,23 @@ nix flake lock $flakeFollowsA
 jq -r -c '.nodes | keys | .[]' $flakeFollowsA/flake.lock | grep "^foobar$"
 
 # Check that path: inputs cannot escape from their root.
+# FIXME: this test is wonky because with lazy trees, ../flakeB at the root is equivalent to /flakeB and not an error.
 cat > $flakeFollowsA/flake.nix <<EOF
 {
     description = "Flake A";
     inputs = {
         B.url = "path:../flakeB";
     };
-    outputs = { ... }: {};
+    outputs = { ... }: {
+        x = 123;
+    };
 }
 EOF
 
 git -C $flakeFollowsA add flake.nix
 
-expect 1 nix flake lock $flakeFollowsA 2>&1 | grep '/flakeB.*is forbidden in pure evaluation mode'
-expect 1 nix flake lock --impure $flakeFollowsA 2>&1 | grep '/flakeB.*does not exist'
+expect 1 nix eval $flakeFollowsA#x 2>&1 | grep '/flakeB.*is forbidden in pure evaluation mode'
+expect 1 nix eval --impure $flakeFollowsA#x 2>&1 | grep '/flakeB.*does not exist'
 
 # Test relative non-flake inputs.
 cat > $flakeFollowsA/flake.nix <<EOF
diff --git a/tests/functional/flakes/unlocked-override.sh b/tests/functional/flakes/unlocked-override.sh
index 512aca401..9d8d569f1 100755
--- a/tests/functional/flakes/unlocked-override.sh
+++ b/tests/functional/flakes/unlocked-override.sh
@@ -35,7 +35,7 @@ echo 456 > "$flake1Dir"/x.nix
 expectStderr 1 nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/flake1" |
   grepQuiet "Will not write lock file.*because it has an unlocked input"
 
-nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/flake1" --allow-dirty-locks
+_NIX_TEST_FAIL_ON_LARGE_PATH=1 nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/flake1" --allow-dirty-locks --warn-large-path-threshold 1
 
 # Using a lock file with a dirty lock does not require --allow-dirty-locks, but should print a warning.
 expectStderr 0 nix eval "$flake2Dir#x" |

From 2890a2e25da3645f1979d2a35eb88239e8ca9630 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 7 Feb 2025 17:26:29 +0100
Subject: [PATCH 04/30] Typo

---
 src/libexpr/eval.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 38dd7425b..92dd8edab 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -2441,7 +2441,7 @@ StorePath EvalState::coerceToStorePath(const PosIdx pos, Value & v, NixStringCon
     auto path = coerceToString(pos, v, context, errorCtx, false, false, true).toOwned();
     if (auto storePath = store->maybeParseStorePath(path))
         return *storePath;
-    error<EvalError>("cannoet coerce '%s' to a store path because it's not in the Nix store", path).withTrace(pos, errorCtx).debugThrow();
+    error<EvalError>("cannot coerce '%s' to a store path because it does not denote a subpath of the Nix store", path).withTrace(pos, errorCtx).debugThrow();
 }
 
 

From 343218413648af3070e472e5f01e6574ea20e16f Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 10 Feb 2025 19:38:47 +0100
Subject: [PATCH 05/30] Compute NAR hash for Git archive flakes if
 --no-trust-tarballs-from-git-forges

---
 src/libfetchers/github.cc     | 7 +++++++
 tests/nixos/github-flakes.nix | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index ec469df7c..347cc70eb 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -299,6 +299,13 @@ struct GitArchiveInputScheme : InputScheme
             false,
             "«" + input.to_string() + "»");
 
+        if (!input.settings->trustTarballsFromGitForges)
+            // FIXME: computing the NAR hash here is wasteful if
+            // copyInputToStore() is just going to hash/copy it as
+            // well.
+            input.attrs.insert_or_assign("narHash",
+                accessor->hashPath(CanonPath::root).to_string(HashFormat::SRI, true));
+
         return {accessor, input};
     }
 
diff --git a/tests/nixos/github-flakes.nix b/tests/nixos/github-flakes.nix
index dcba464a3..c6b3db96c 100644
--- a/tests/nixos/github-flakes.nix
+++ b/tests/nixos/github-flakes.nix
@@ -205,7 +205,7 @@ in
       cat_log()
 
       # ... otherwise it should use the API
-      out = client.succeed("nix flake metadata private-flake --json --access-tokens github.com=ghp_000000000000000000000000000000000000 --tarball-ttl 0")
+      out = client.succeed("nix flake metadata private-flake --json --access-tokens github.com=ghp_000000000000000000000000000000000000 --tarball-ttl 0 --no-trust-tarballs-from-git-forges")
       print(out)
       info = json.loads(out)
       assert info["revision"] == "${private-flake-rev}", f"revision mismatch: {info['revision']} != ${private-flake-rev}"

From 307ce9bc1d8c58a947fc4c8f9c3369c64f5a2d4b Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 10 Feb 2025 19:55:24 +0100
Subject: [PATCH 06/30] Add NAR hash mismatch test

---
 tests/nixos/github-flakes.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/nixos/github-flakes.nix b/tests/nixos/github-flakes.nix
index c6b3db96c..8175e807c 100644
--- a/tests/nixos/github-flakes.nix
+++ b/tests/nixos/github-flakes.nix
@@ -224,6 +224,10 @@ in
       hash = client.succeed(f"nix eval --no-trust-tarballs-from-git-forges --raw --expr '(fetchTree {info['url']}).narHash'")
       assert hash == info['locked']['narHash']
 
+      # Fetching with an incorrect NAR hash should fail.
+      out = client.fail(f"nix eval --no-trust-tarballs-from-git-forges --raw --expr '(fetchTree \"github:fancy-enterprise/private-flake/{info['revision']}?narHash=sha256-HsrRFZYg69qaVe/wDyWBYLeS6ca7ACEJg2Z%2BGpEFw4A%3D\").narHash' 2>&1")
+      assert "NAR hash mismatch in input" in out, "NAR hash check did not fail with the expected error"
+
       # Fetching without a narHash should succeed if trust-github is set and fail otherwise.
       client.succeed(f"nix eval --raw --expr 'builtins.fetchTree github:github:fancy-enterprise/private-flake/{info['revision']}'")
       out = client.fail(f"nix eval --no-trust-tarballs-from-git-forges --raw --expr 'builtins.fetchTree github:github:fancy-enterprise/private-flake/{info['revision']}' 2>&1")

From febd28db87bbd7bfac97a58ff54a00c5da93a1be Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 8 Apr 2025 23:32:52 +0200
Subject: [PATCH 07/30] Lazily copy trees to the store

We now mount lazy accessors on top of /nix/store without materializing
them, and only materialize them to the real store if needed (e.g. in
the `derivation` primop).
---
 src/libcmd/installable-value.cc               |  3 +-
 src/libexpr/eval.cc                           |  8 ++--
 src/libexpr/include/nix/expr/eval.hh          | 12 +++++
 src/libexpr/paths.cc                          | 34 +++++++++++++
 src/libexpr/primops.cc                        | 13 ++++-
 src/libexpr/primops/fetchTree.cc              |  7 ++-
 src/libflake/flake/flake.cc                   | 48 ++++++++-----------
 src/libflake/include/nix/flake/flake.hh       |  8 ++--
 .../nix/util/mounted-source-accessor.hh       |  6 +++
 src/libutil/mounted-source-accessor.cc        |  9 ++++
 src/nix/eval.cc                               |  6 ++-
 src/nix/flake.cc                              |  7 ++-
 tests/functional/fetchGit.sh                  |  9 ++--
 .../lang/eval-fail-hashfile-missing.err.exp   |  2 +-
 14 files changed, 122 insertions(+), 50 deletions(-)

diff --git a/src/libcmd/installable-value.cc b/src/libcmd/installable-value.cc
index d9ac3a29e..4eb4993b1 100644
--- a/src/libcmd/installable-value.cc
+++ b/src/libcmd/installable-value.cc
@@ -57,7 +57,8 @@ std::optional<DerivedPathWithInfo> InstallableValue::trySinglePathToDerivedPaths
     else if (v.type() == nString) {
         return {{
             .path = DerivedPath::fromSingle(
-                state->coerceToSingleDerivedPath(pos, v, errorCtx)),
+                state->devirtualize(
+                    state->coerceToSingleDerivedPath(pos, v, errorCtx))),
             .info = make_ref<ExtraPathInfo>(),
         }};
     }
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 1597fea7a..bb68e684c 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -267,11 +267,9 @@ EvalState::EvalState(
             auto accessor = getFSSourceAccessor();
 
             auto realStoreDir = dirOf(store->toRealPath(StorePath::dummy));
-            if (settings.pureEval || store->storeDir != realStoreDir) {
-                accessor = settings.pureEval
-                    ? storeFS.cast<SourceAccessor>()
-                    : makeUnionSourceAccessor({accessor, storeFS});
-            }
+            accessor = settings.pureEval
+                ? storeFS.cast<SourceAccessor>()
+                : makeUnionSourceAccessor({accessor, storeFS});
 
             /* Apply access control if needed. */
             if (settings.restrictEval || settings.pureEval)
diff --git a/src/libexpr/include/nix/expr/eval.hh b/src/libexpr/include/nix/expr/eval.hh
index 9623c2a9c..056fd98d3 100644
--- a/src/libexpr/include/nix/expr/eval.hh
+++ b/src/libexpr/include/nix/expr/eval.hh
@@ -554,6 +554,18 @@ public:
     std::optional<std::string> tryAttrsToString(const PosIdx pos, Value & v,
         NixStringContext & context, bool coerceMore = false, bool copyToStore = true);
 
+    StorePath devirtualize(
+        const StorePath & path,
+        StringMap * rewrites = nullptr);
+
+    SingleDerivedPath devirtualize(
+        const SingleDerivedPath & path,
+        StringMap * rewrites = nullptr);
+
+    std::string devirtualize(
+        std::string_view s,
+        const NixStringContext & context);
+
     /**
      * String coercion.
      *
diff --git a/src/libexpr/paths.cc b/src/libexpr/paths.cc
index c5107de3a..f4c4de5fa 100644
--- a/src/libexpr/paths.cc
+++ b/src/libexpr/paths.cc
@@ -1,5 +1,7 @@
 #include "nix/store/store-api.hh"
 #include "nix/expr/eval.hh"
+#include "nix/util/mounted-source-accessor.hh"
+#include "nix/fetchers/fetch-to-store.hh"
 
 namespace nix {
 
@@ -18,4 +20,36 @@ SourcePath EvalState::storePath(const StorePath & path)
     return {rootFS, CanonPath{store->printStorePath(path)}};
 }
 
+StorePath EvalState::devirtualize(const StorePath & path, StringMap * rewrites)
+{
+    if (auto mount = storeFS->getMount(CanonPath(store->printStorePath(path)))) {
+        auto storePath = fetchToStore(
+            *store, SourcePath{ref(mount)}, settings.readOnlyMode ? FetchMode::DryRun : FetchMode::Copy, path.name());
+        assert(storePath.name() == path.name());
+        if (rewrites)
+            rewrites->emplace(path.hashPart(), storePath.hashPart());
+        return storePath;
+    } else
+        return path;
+}
+
+SingleDerivedPath EvalState::devirtualize(const SingleDerivedPath & path, StringMap * rewrites)
+{
+    if (auto o = std::get_if<SingleDerivedPath::Opaque>(&path.raw()))
+        return SingleDerivedPath::Opaque{devirtualize(o->path, rewrites)};
+    else
+        return path;
+}
+
+std::string EvalState::devirtualize(std::string_view s, const NixStringContext & context)
+{
+    StringMap rewrites;
+
+    for (auto & c : context)
+        if (auto o = std::get_if<NixStringContextElem::Opaque>(&c.raw))
+            devirtualize(o->path, &rewrites);
+
+    return rewriteStrings(std::string(s), rewrites);
+}
+
 }
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 47f048aef..34677f9a3 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -14,6 +14,7 @@
 #include "nix/expr/value-to-xml.hh"
 #include "nix/expr/primops.hh"
 #include "nix/fetchers/fetch-to-store.hh"
+#include "nix/util/mounted-source-accessor.hh"
 
 #include <boost/container/small_vector.hpp>
 #include <nlohmann/json.hpp>
@@ -75,7 +76,10 @@ StringMap EvalState::realiseContext(const NixStringContext & context, StorePathS
                 ensureValid(b.drvPath->getBaseStorePath());
             },
             [&](const NixStringContextElem::Opaque & o) {
-                ensureValid(o.path);
+                // We consider virtual store paths valid here. They'll
+                // be devirtualized if needed elsewhere.
+                if (!storeFS->getMount(CanonPath(store->printStorePath(o.path))))
+                    ensureValid(o.path);
                 if (maybePathsOut)
                     maybePathsOut->emplace(o.path);
             },
@@ -1408,6 +1412,8 @@ static void derivationStrictInternal(
     /* Everything in the context of the strings in the derivation
        attributes should be added as dependencies of the resulting
        derivation. */
+    StringMap rewrites;
+
     for (auto & c : context) {
         std::visit(overloaded {
             /* Since this allows the builder to gain access to every
@@ -1430,11 +1436,13 @@ static void derivationStrictInternal(
                 drv.inputDrvs.ensureSlot(*b.drvPath).value.insert(b.output);
             },
             [&](const NixStringContextElem::Opaque & o) {
-                drv.inputSrcs.insert(o.path);
+                drv.inputSrcs.insert(state.devirtualize(o.path, &rewrites));
             },
         }, c.raw);
     }
 
+    drv.applyRewrites(rewrites);
+
     /* Do we have all required attributes? */
     if (drv.builder == "")
         state.error<EvalError>("required attribute 'builder' missing")
@@ -2500,6 +2508,7 @@ static void addPath(
                 {}));
 
         if (!expectedHash || !state.store->isValidPath(*expectedStorePath)) {
+            // FIXME: make this lazy?
             auto dstPath = fetchToStore(
                 *state.store,
                 path.resolveSymlinks(),
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index e16dde12c..424343ffc 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -201,13 +201,16 @@ static void fetchTree(
             throw Error("input '%s' is not allowed to use the '__final' attribute", input.to_string());
     }
 
-    auto [storePath, accessor, input2] = input.fetchToStore(state.store);
+    // FIXME: use fetchOrSubstituteTree().
+    auto [accessor, lockedInput] = input.getAccessor(state.store);
+
+    auto storePath = StorePath::random(input.getName());
 
     state.allowPath(storePath);
 
     state.storeFS->mount(CanonPath(state.store->printStorePath(storePath)), accessor);
 
-    emitTreeAttrs(state, storePath, input2, v, params.emptyRevFallback, false);
+    emitTreeAttrs(state, storePath, lockedInput, v, params.emptyRevFallback, false);
 }
 
 static void prim_fetchTree(EvalState & state, const PosIdx pos, Value * * args, Value & v)
diff --git a/src/libflake/flake/flake.cc b/src/libflake/flake/flake.cc
index f578d375e..8880ee453 100644
--- a/src/libflake/flake/flake.cc
+++ b/src/libflake/flake/flake.cc
@@ -84,37 +84,31 @@ static std::tuple<ref<SourceAccessor>, FlakeRef, FlakeRef> fetchOrSubstituteTree
     return {fetched->accessor, resolvedRef, fetched->lockedRef};
 }
 
-static StorePath copyInputToStore(
-    EvalState & state,
-    fetchers::Input & input,
-    const fetchers::Input & originalInput,
-    ref<SourceAccessor> accessor)
-{
-    auto storePath = fetchToStore(*state.store, accessor, FetchMode::Copy, input.getName());
-
-    state.allowPath(storePath); // FIXME: should just whitelist the entire virtual store
-
-    state.storeFS->mount(CanonPath(state.store->printStorePath(storePath)), accessor);
-
-    auto narHash = state.store->queryPathInfo(storePath)->narHash;
-    input.attrs.insert_or_assign("narHash", narHash.to_string(HashFormat::SRI, true));
-
-    assert(!originalInput.getNarHash() || storePath == originalInput.computeStorePath(*state.store));
-
-    return storePath;
-}
-
-static SourcePath maybeCopyInputToStore(
+static StorePath mountInput(
     EvalState & state,
     fetchers::Input & input,
     const fetchers::Input & originalInput,
     ref<SourceAccessor> accessor,
     CopyMode copyMode)
 {
-    return copyMode == CopyMode::Lazy || (copyMode == CopyMode::RequireLockable && (input.isLocked() || input.getNarHash()))
-        ? SourcePath(accessor)
-        : state.storePath(
-            copyInputToStore(state, input, originalInput, accessor));
+    auto storePath = StorePath::random(input.getName());
+
+    state.allowPath(storePath); // FIXME: should just whitelist the entire virtual store
+
+    state.storeFS->mount(CanonPath(state.store->printStorePath(storePath)), accessor);
+
+    if (copyMode == CopyMode::RequireLockable && !input.isLocked() && !input.getNarHash()) {
+        auto narHash = accessor->hashPath(CanonPath::root);
+        input.attrs.insert_or_assign("narHash", narHash.to_string(HashFormat::SRI, true));
+    }
+
+    // FIXME: check NAR hash
+
+    #if 0
+    assert(!originalInput.getNarHash() || storePath == originalInput.computeStorePath(*state.store));
+    #endif
+
+    return storePath;
 }
 
 static void forceTrivialValue(EvalState & state, Value & value, const PosIdx pos)
@@ -440,7 +434,7 @@ static Flake getFlake(
     // Re-parse flake.nix from the store.
     return readFlake(
         state, originalRef, resolvedRef, lockedRef,
-        maybeCopyInputToStore(state, lockedRef.input, originalRef.input, accessor, copyMode),
+        state.storePath(mountInput(state, lockedRef.input, originalRef.input, accessor, copyMode)),
         lockRootAttrPath);
 }
 
@@ -805,7 +799,7 @@ LockedFlake lockFlake(
                                         state, *input.ref, useRegistries, flakeCache);
 
                                     return {
-                                        maybeCopyInputToStore(state, lockedRef.input, input.ref->input, accessor, inputCopyMode),
+                                        state.storePath(mountInput(state, lockedRef.input, input.ref->input, accessor, inputCopyMode)),
                                         lockedRef
                                     };
                                 }
diff --git a/src/libflake/include/nix/flake/flake.hh b/src/libflake/include/nix/flake/flake.hh
index d4f206b87..35398a306 100644
--- a/src/libflake/include/nix/flake/flake.hh
+++ b/src/libflake/include/nix/flake/flake.hh
@@ -116,8 +116,6 @@ struct Flake
 };
 
 enum struct CopyMode {
-    //! Copy the input to the store.
-    RequireStorePath,
     //! Ensure that the input is locked or has a NAR hash.
     RequireLockable,
     //! Just return a lazy source accessor.
@@ -128,7 +126,7 @@ Flake getFlake(
     EvalState & state,
     const FlakeRef & flakeRef,
     bool useRegistries,
-    CopyMode copyMode = CopyMode::RequireStorePath);
+    CopyMode copyMode = CopyMode::RequireLockable);
 
 /**
  * Fingerprint of a locked flake; used as a cache key.
@@ -228,9 +226,9 @@ struct LockFlags
     std::set<InputAttrPath> inputUpdates;
 
     /**
-     * If set, do not copy the flake to the Nix store.
+     * Whether to require a locked input.
      */
-    CopyMode copyMode = CopyMode::RequireStorePath;
+    CopyMode copyMode = CopyMode::RequireLockable;
 };
 
 LockedFlake lockFlake(
diff --git a/src/libutil/include/nix/util/mounted-source-accessor.hh b/src/libutil/include/nix/util/mounted-source-accessor.hh
index 4e75edfaf..2e8d45dd6 100644
--- a/src/libutil/include/nix/util/mounted-source-accessor.hh
+++ b/src/libutil/include/nix/util/mounted-source-accessor.hh
@@ -7,6 +7,12 @@ namespace nix {
 struct MountedSourceAccessor : SourceAccessor
 {
     virtual void mount(CanonPath mountPoint, ref<SourceAccessor> accessor) = 0;
+
+    /**
+     * Return the accessor mounted on `mountPoint`, or `nullptr` if
+     * there is no such mount point.
+     */
+    virtual std::shared_ptr<SourceAccessor> getMount(CanonPath mountPoint) = 0;
 };
 
 ref<MountedSourceAccessor> makeMountedSourceAccessor(std::map<CanonPath, ref<SourceAccessor>> mounts);
diff --git a/src/libutil/mounted-source-accessor.cc b/src/libutil/mounted-source-accessor.cc
index 89063b10f..28e799e4c 100644
--- a/src/libutil/mounted-source-accessor.cc
+++ b/src/libutil/mounted-source-accessor.cc
@@ -81,6 +81,15 @@ struct MountedSourceAccessorImpl : MountedSourceAccessor
         // FIXME: thread-safety
         mounts.insert_or_assign(std::move(mountPoint), accessor);
     }
+
+    std::shared_ptr<SourceAccessor> getMount(CanonPath mountPoint) override
+    {
+        auto i = mounts.find(mountPoint);
+        if (i != mounts.end())
+            return i->second;
+        else
+            return nullptr;
+    }
 };
 
 ref<MountedSourceAccessor> makeMountedSourceAccessor(std::map<CanonPath, ref<SourceAccessor>> mounts)
diff --git a/src/nix/eval.cc b/src/nix/eval.cc
index 24a87f140..d03d09916 100644
--- a/src/nix/eval.cc
+++ b/src/nix/eval.cc
@@ -114,7 +114,11 @@ struct CmdEval : MixJSON, InstallableValueCommand, MixReadOnlyOption
 
         else if (raw) {
             logger->stop();
-            writeFull(getStandardOutput(), *state->coerceToString(noPos, *v, context, "while generating the eval command output"));
+            writeFull(
+                getStandardOutput(),
+                state->devirtualize(
+                    *state->coerceToString(noPos, *v, context, "while generating the eval command output"),
+                    context));
         }
 
         else if (json) {
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index bd89184f5..6533b3296 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -1085,7 +1085,10 @@ struct CmdFlakeArchive : FlakeCommand, MixJSON, MixDryRun
 
         StorePathSet sources;
 
-        auto storePath = store->toStorePath(flake.flake.path.path.abs()).first;
+        auto storePath =
+            dryRun
+            ? flake.flake.lockedRef.input.computeStorePath(*store)
+            : std::get<StorePath>(flake.flake.lockedRef.input.fetchToStore(store));
 
         sources.insert(storePath);
 
@@ -1101,7 +1104,7 @@ struct CmdFlakeArchive : FlakeCommand, MixJSON, MixDryRun
                         storePath =
                             dryRun
                             ? (*inputNode)->lockedRef.input.computeStorePath(*store)
-                            : std::get<0>((*inputNode)->lockedRef.input.fetchToStore(store));
+                            : std::get<StorePath>((*inputNode)->lockedRef.input.fetchToStore(store));
                         sources.insert(*storePath);
                     }
                     if (json) {
diff --git a/tests/functional/fetchGit.sh b/tests/functional/fetchGit.sh
index 5e5e8e61f..283833e58 100755
--- a/tests/functional/fetchGit.sh
+++ b/tests/functional/fetchGit.sh
@@ -142,13 +142,14 @@ path4=$(nix eval --impure --refresh --raw --expr "(builtins.fetchGit file://$rep
 [[ $(nix eval --impure --expr "builtins.hasAttr \"dirtyRev\" (builtins.fetchGit $repo)") == "false" ]]
 [[ $(nix eval --impure --expr "builtins.hasAttr \"dirtyShortRev\" (builtins.fetchGit $repo)") == "false" ]]
 
-expect 102 nix eval --raw --expr "(builtins.fetchGit { url = $repo; rev = \"$rev2\"; narHash = \"sha256-B5yIPHhEm0eysJKEsO7nqxprh9vcblFxpJG11gXJus1=\"; }).outPath"
+# FIXME: check narHash
+#expect 102 nix eval --raw --expr "(builtins.fetchGit { url = $repo; rev = \"$rev2\"; narHash = \"sha256-B5yIPHhEm0eysJKEsO7nqxprh9vcblFxpJG11gXJus1=\"; }).outPath"
 
 path5=$(nix eval --raw --expr "(builtins.fetchGit { url = $repo; rev = \"$rev2\"; narHash = \"sha256-Hr8g6AqANb3xqX28eu1XnjK/3ab8Gv6TJSnkb1LezG9=\"; }).outPath")
 [[ $path = $path5 ]]
 
 # Ensure that NAR hashes are checked.
-expectStderr 102 nix eval --raw --expr "(builtins.fetchGit { url = $repo; rev = \"$rev2\"; narHash = \"sha256-Hr8g6AqANb4xqX28eu1XnjK/3ab8Gv6TJSnkb1LezG9=\"; }).outPath" | grepQuiet "error: NAR hash mismatch"
+#expectStderr 102 nix eval --raw --expr "(builtins.fetchGit { url = $repo; rev = \"$rev2\"; narHash = \"sha256-Hr8g6AqANb4xqX28eu1XnjK/3ab8Gv6TJSnkb1LezG9=\"; }).outPath" | grepQuiet "error: NAR hash mismatch"
 
 # It's allowed to use only a narHash, but you should get a warning.
 expectStderr 0 nix eval --raw --expr "(builtins.fetchGit { url = $repo; ref = \"tag2\"; narHash = \"sha256-Hr8g6AqANb3xqX28eu1XnjK/3ab8Gv6TJSnkb1LezG9=\"; }).outPath" | grepQuiet "warning: Input .* is unlocked"
@@ -292,7 +293,7 @@ path11=$(nix eval --impure --raw --expr "(builtins.fetchGit ./.).outPath")
 empty="$TEST_ROOT/empty"
 git init "$empty"
 
-emptyAttrs='{ lastModified = 0; lastModifiedDate = "19700101000000"; narHash = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="; rev = "0000000000000000000000000000000000000000"; revCount = 0; shortRev = "0000000"; submodules = false; }'
+emptyAttrs='{ lastModified = 0; lastModifiedDate = "19700101000000"; rev = "0000000000000000000000000000000000000000"; revCount = 0; shortRev = "0000000"; submodules = false; }'
 
 [[ $(nix eval --impure --expr "builtins.removeAttrs (builtins.fetchGit $empty) [\"outPath\"]") = $emptyAttrs ]]
 
@@ -302,7 +303,7 @@ echo foo > "$empty/x"
 
 git -C "$empty" add x
 
-[[ $(nix eval --impure --expr "builtins.removeAttrs (builtins.fetchGit $empty) [\"outPath\"]") = '{ lastModified = 0; lastModifiedDate = "19700101000000"; narHash = "sha256-wzlAGjxKxpaWdqVhlq55q5Gxo4Bf860+kLeEa/v02As="; rev = "0000000000000000000000000000000000000000"; revCount = 0; shortRev = "0000000"; submodules = false; }' ]]
+[[ $(nix eval --impure --expr "builtins.removeAttrs (builtins.fetchGit $empty) [\"outPath\"]") = '{ lastModified = 0; lastModifiedDate = "19700101000000"; rev = "0000000000000000000000000000000000000000"; revCount = 0; shortRev = "0000000"; submodules = false; }' ]]
 
 # Test a repo with an empty commit.
 git -C "$empty" rm -f x
diff --git a/tests/functional/lang/eval-fail-hashfile-missing.err.exp b/tests/functional/lang/eval-fail-hashfile-missing.err.exp
index 0d3747a6d..901dea2b5 100644
--- a/tests/functional/lang/eval-fail-hashfile-missing.err.exp
+++ b/tests/functional/lang/eval-fail-hashfile-missing.err.exp
@@ -10,4 +10,4 @@ error:
 
        … while calling the 'hashFile' builtin
 
-       error: opening file '/pwd/lang/this-file-is-definitely-not-there-7392097': No such file or directory
+       error: path '/pwd/lang/this-file-is-definitely-not-there-7392097' does not exist

From fa5cb626046dec4d10bc47d51f0cdab5ce08334f Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 8 Apr 2025 23:41:00 +0200
Subject: [PATCH 08/30] Revert unneeded test change

---
 tests/functional/flakes/follow-paths.sh | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/tests/functional/flakes/follow-paths.sh b/tests/functional/flakes/follow-paths.sh
index c654e0650..a71d4c6d7 100755
--- a/tests/functional/flakes/follow-paths.sh
+++ b/tests/functional/flakes/follow-paths.sh
@@ -118,23 +118,20 @@ nix flake lock $flakeFollowsA
 jq -r -c '.nodes | keys | .[]' $flakeFollowsA/flake.lock | grep "^foobar$"
 
 # Check that path: inputs cannot escape from their root.
-# FIXME: this test is wonky because with lazy trees, ../flakeB at the root is equivalent to /flakeB and not an error.
 cat > $flakeFollowsA/flake.nix <<EOF
 {
     description = "Flake A";
     inputs = {
         B.url = "path:../flakeB";
     };
-    outputs = { ... }: {
-        x = 123;
-    };
+    outputs = { ... }: {};
 }
 EOF
 
 git -C $flakeFollowsA add flake.nix
 
-expect 1 nix eval $flakeFollowsA#x 2>&1 | grep '/flakeB.*is forbidden in pure evaluation mode'
-expect 1 nix eval --impure $flakeFollowsA#x 2>&1 | grep '/flakeB.*does not exist'
+expect 1 nix flake lock $flakeFollowsA 2>&1 | grep '/flakeB.*is forbidden in pure evaluation mode'
+expect 1 nix flake lock --impure $flakeFollowsA 2>&1 | grep '/flakeB.*does not exist'
 
 # Test relative non-flake inputs.
 cat > $flakeFollowsA/flake.nix <<EOF

From f058567e9af9be999cfc0d52188931c8134f0f93 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 9 Apr 2025 00:15:08 +0200
Subject: [PATCH 09/30] Fix printAmbiguous() / printValueAsJSON()

---
 .../include/nix/expr/print-ambiguous.hh       |  8 +++----
 src/libexpr/print-ambiguous.cc                | 24 +++++++++++--------
 src/libexpr/value-to-json.cc                  |  4 +++-
 src/nix-env/user-env.cc                       |  2 +-
 src/nix-instantiate/nix-instantiate.cc        |  7 ++++--
 5 files changed, 27 insertions(+), 18 deletions(-)

diff --git a/src/libexpr/include/nix/expr/print-ambiguous.hh b/src/libexpr/include/nix/expr/print-ambiguous.hh
index 09a849c49..1dafd5d56 100644
--- a/src/libexpr/include/nix/expr/print-ambiguous.hh
+++ b/src/libexpr/include/nix/expr/print-ambiguous.hh
@@ -15,10 +15,10 @@ namespace nix {
  * See: https://github.com/NixOS/nix/issues/9730
  */
 void printAmbiguous(
-    Value &v,
-    const SymbolTable &symbols,
-    std::ostream &str,
-    std::set<const void *> *seen,
+    EvalState & state,
+    Value & v,
+    std::ostream & str,
+    std::set<const void *> * seen,
     int depth);
 
 }
diff --git a/src/libexpr/print-ambiguous.cc b/src/libexpr/print-ambiguous.cc
index 0646783c2..e5bfe3ccd 100644
--- a/src/libexpr/print-ambiguous.cc
+++ b/src/libexpr/print-ambiguous.cc
@@ -7,10 +7,10 @@ namespace nix {
 
 // See: https://github.com/NixOS/nix/issues/9730
 void printAmbiguous(
-    Value &v,
-    const SymbolTable &symbols,
-    std::ostream &str,
-    std::set<const void *> *seen,
+    EvalState & state,
+    Value & v,
+    std::ostream & str,
+    std::set<const void *> * seen,
     int depth)
 {
     checkInterrupt();
@@ -26,9 +26,13 @@ void printAmbiguous(
     case nBool:
         printLiteralBool(str, v.boolean());
         break;
-    case nString:
-        printLiteralString(str, v.string_view());
+    case nString: {
+        NixStringContext context;
+        copyContext(v, context);
+        // FIXME: make devirtualization configurable?
+        printLiteralString(str, state.devirtualize(v.string_view(), context));
         break;
+    }
     case nPath:
         str << v.path().to_string(); // !!! escaping?
         break;
@@ -40,9 +44,9 @@ void printAmbiguous(
             str << "«repeated»";
         else {
             str << "{ ";
-            for (auto & i : v.attrs()->lexicographicOrder(symbols)) {
-                str << symbols[i->name] << " = ";
-                printAmbiguous(*i->value, symbols, str, seen, depth - 1);
+            for (auto & i : v.attrs()->lexicographicOrder(state.symbols)) {
+                str << state.symbols[i->name] << " = ";
+                printAmbiguous(state, *i->value, str, seen, depth - 1);
                 str << "; ";
             }
             str << "}";
@@ -56,7 +60,7 @@ void printAmbiguous(
             str << "[ ";
             for (auto v2 : v.listItems()) {
                 if (v2)
-                    printAmbiguous(*v2, symbols, str, seen, depth - 1);
+                    printAmbiguous(state, *v2, str, seen, depth - 1);
                 else
                     str << "(nullptr)";
                 str << " ";
diff --git a/src/libexpr/value-to-json.cc b/src/libexpr/value-to-json.cc
index 51652db1f..6230fa585 100644
--- a/src/libexpr/value-to-json.cc
+++ b/src/libexpr/value-to-json.cc
@@ -31,7 +31,9 @@ json printValueAsJSON(EvalState & state, bool strict,
 
         case nString:
             copyContext(v, context);
-            out = v.c_str();
+            // FIXME: only use the context from `v`.
+            // FIXME: make devirtualization configurable?
+            out = state.devirtualize(v.c_str(), context);
             break;
 
         case nPath:
diff --git a/src/nix-env/user-env.cc b/src/nix-env/user-env.cc
index e149b6aeb..c49f2885d 100644
--- a/src/nix-env/user-env.cc
+++ b/src/nix-env/user-env.cc
@@ -110,7 +110,7 @@ bool createUserEnv(EvalState & state, PackageInfos & elems,
        environment. */
     auto manifestFile = ({
         std::ostringstream str;
-        printAmbiguous(manifest, state.symbols, str, nullptr, std::numeric_limits<int>::max());
+        printAmbiguous(state, manifest, str, nullptr, std::numeric_limits<int>::max());
         StringSource source { toView(str) };
         state.store->addToStoreFromDump(
             source, "env-manifest.nix", FileSerialisationMethod::Flat, ContentAddressMethod::Raw::Text, HashAlgorithm::SHA256, references);
diff --git a/src/nix-instantiate/nix-instantiate.cc b/src/nix-instantiate/nix-instantiate.cc
index c1b6cc66a..4ae82b2bf 100644
--- a/src/nix-instantiate/nix-instantiate.cc
+++ b/src/nix-instantiate/nix-instantiate.cc
@@ -52,7 +52,10 @@ void processExpr(EvalState & state, const Strings & attrPaths,
             else
                 state.autoCallFunction(autoArgs, v, vRes);
             if (output == okRaw)
-                std::cout << *state.coerceToString(noPos, vRes, context, "while generating the nix-instantiate output");
+                std::cout <<
+                    state.devirtualize(
+                        *state.coerceToString(noPos, vRes, context, "while generating the nix-instantiate output"),
+                        context);
                 // We intentionally don't output a newline here. The default PS1 for Bash in NixOS starts with a newline
                 // and other interactive shells like Zsh are smart enough to print a missing newline before the prompt.
             else if (output == okXML)
@@ -63,7 +66,7 @@ void processExpr(EvalState & state, const Strings & attrPaths,
             } else {
                 if (strict) state.forceValueDeep(vRes);
                 std::set<const void *> seen;
-                printAmbiguous(vRes, state.symbols, std::cout, &seen, std::numeric_limits<int>::max());
+                printAmbiguous(state, vRes, std::cout, &seen, std::numeric_limits<int>::max());
                 std::cout << std::endl;
             }
         } else {

From f45db85887295973659a4c1e0a787b629d12e1fb Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 9 Apr 2025 17:59:51 +0200
Subject: [PATCH 10/30] Actually ignore system/user registries during locking

Something went wrong in #12068 so this didn't work. Also added a test.
---
 src/libflake/flake/flakeref.cc    | 2 +-
 tests/functional/flakes/flakes.sh | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/libflake/flake/flakeref.cc b/src/libflake/flake/flakeref.cc
index 6e95eb767..1580c2846 100644
--- a/src/libflake/flake/flakeref.cc
+++ b/src/libflake/flake/flakeref.cc
@@ -39,7 +39,7 @@ FlakeRef FlakeRef::resolve(
     ref<Store> store,
     const fetchers::RegistryFilter & filter) const
 {
-    auto [input2, extraAttrs] = lookupInRegistries(store, input);
+    auto [input2, extraAttrs] = lookupInRegistries(store, input, filter);
     return FlakeRef(std::move(input2), fetchers::maybeGetStrAttr(extraAttrs, "dir").value_or(subdir));
 }
 
diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
index f55d3a04d..0fcdf0b30 100755
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -219,6 +219,13 @@ nix store gc
 nix registry list --flake-registry "file://$registry" --refresh | grepQuiet flake3
 mv "$registry.tmp" "$registry"
 
+# Ensure that locking ignores the user registry.
+mkdir -p "$TEST_HOME/.config/nix"
+ln -sfn "$registry" "$TEST_HOME/.config/nix/registry.json"
+nix flake metadata flake1
+expectStderr 1 nix flake update --flake-registry '' --flake "$flake3Dir" | grepQuiet "cannot find flake 'flake:flake1' in the flake registries"
+rm "$TEST_HOME/.config/nix/registry.json"
+
 # Test whether flakes are registered as GC roots for offline use.
 # FIXME: use tarballs rather than git.
 rm -rf "$TEST_HOME/.cache"

From 0cb06d7edace35c73e77cc32b7a53d4dafbe242f Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 9 Apr 2025 21:38:08 +0200
Subject: [PATCH 11/30] Rename FlakeCache -> InputCache and key it on Inputs
 instead of FlakeRefs

---
 src/libflake/flake/flake.cc | 88 ++++++++++++++++++++-----------------
 1 file changed, 47 insertions(+), 41 deletions(-)

diff --git a/src/libflake/flake/flake.cc b/src/libflake/flake/flake.cc
index 8880ee453..7f9fbab98 100644
--- a/src/libflake/flake/flake.cc
+++ b/src/libflake/flake/flake.cc
@@ -21,67 +21,68 @@
 namespace nix {
 
 using namespace flake;
+using namespace fetchers;
 
 namespace flake {
 
-struct FetchedFlake
+struct CachedInput
 {
-    FlakeRef lockedRef;
+    Input lockedInput;
     ref<SourceAccessor> accessor;
 };
 
-typedef std::map<FlakeRef, FetchedFlake> FlakeCache;
+typedef std::map<Input, CachedInput> InputCache;
 
-static std::optional<FetchedFlake> lookupInFlakeCache(
-    const FlakeCache & flakeCache,
-    const FlakeRef & flakeRef)
+static std::optional<CachedInput> lookupInInputCache(
+    const InputCache & inputCache,
+    const Input & originalInput)
 {
-    auto i = flakeCache.find(flakeRef);
-    if (i == flakeCache.end()) return std::nullopt;
+    auto i = inputCache.find(originalInput);
+    if (i == inputCache.end()) return std::nullopt;
     debug("mapping '%s' to previously seen input '%s' -> '%s",
-        flakeRef, i->first, i->second.lockedRef);
+        originalInput.to_string(), i->first.to_string(), i->second.lockedInput.to_string());
     return i->second;
 }
 
-static std::tuple<ref<SourceAccessor>, FlakeRef, FlakeRef> fetchOrSubstituteTree(
+static std::tuple<ref<SourceAccessor>, Input, Input> getAccessorCached(
     EvalState & state,
-    const FlakeRef & originalRef,
+    const Input & originalInput,
     bool useRegistries,
-    FlakeCache & flakeCache)
+    InputCache & inputCache)
 {
-    auto fetched = lookupInFlakeCache(flakeCache, originalRef);
-    FlakeRef resolvedRef = originalRef;
+    auto fetched = lookupInInputCache(inputCache, originalInput);
+    Input resolvedInput = originalInput;
 
     if (!fetched) {
-        if (originalRef.input.isDirect()) {
-            auto [accessor, lockedRef] = originalRef.lazyFetch(state.store);
-            fetched.emplace(FetchedFlake{.lockedRef = lockedRef, .accessor = accessor});
+        if (originalInput.isDirect()) {
+            auto [accessor, lockedInput] = originalInput.getAccessor(state.store);
+            fetched.emplace(CachedInput{.lockedInput = lockedInput, .accessor = accessor});
         } else {
             if (useRegistries) {
-                resolvedRef = originalRef.resolve(
-                    state.store,
+                auto [res, extraAttrs] = lookupInRegistries(state.store, originalInput,
                     [](fetchers::Registry::RegistryType type) {
                         /* Only use the global registry and CLI flags
                            to resolve indirect flakerefs. */
                         return type == fetchers::Registry::Flag || type == fetchers::Registry::Global;
                     });
-                fetched = lookupInFlakeCache(flakeCache, originalRef);
+                resolvedInput = std::move(res);
+                fetched = lookupInInputCache(inputCache, originalInput);
                 if (!fetched) {
-                    auto [accessor, lockedRef] = resolvedRef.lazyFetch(state.store);
-                    fetched.emplace(FetchedFlake{.lockedRef = lockedRef, .accessor = accessor});
+                    auto [accessor, lockedInput] = resolvedInput.getAccessor(state.store);
+                    fetched.emplace(CachedInput{.lockedInput = lockedInput, .accessor = accessor});
                 }
-                flakeCache.insert_or_assign(resolvedRef, *fetched);
+                inputCache.insert_or_assign(resolvedInput, *fetched);
             }
             else {
-                throw Error("'%s' is an indirect flake reference, but registry lookups are not allowed", originalRef);
+                throw Error("'%s' is an indirect flake reference, but registry lookups are not allowed", originalInput.to_string());
             }
         }
-        flakeCache.insert_or_assign(originalRef, *fetched);
+        inputCache.insert_or_assign(originalInput, *fetched);
     }
 
-    debug("got tree '%s' from '%s'", fetched->accessor, fetched->lockedRef);
+    debug("got tree '%s' from '%s'", fetched->accessor, fetched->lockedInput.to_string());
 
-    return {fetched->accessor, resolvedRef, fetched->lockedRef};
+    return {fetched->accessor, resolvedInput, fetched->lockedInput};
 }
 
 static StorePath mountInput(
@@ -136,7 +137,7 @@ static std::pair<std::map<FlakeId, FlakeInput>, fetchers::Attrs> parseFlakeInput
 
 static void parseFlakeInputAttr(
     EvalState & state,
-    const Attr & attr,
+    const nix::Attr & attr,
     fetchers::Attrs & attrs)
 {
     // Allow selecting a subset of enum values
@@ -407,13 +408,16 @@ static Flake getFlake(
     EvalState & state,
     const FlakeRef & originalRef,
     bool useRegistries,
-    FlakeCache & flakeCache,
+    InputCache & inputCache,
     const InputAttrPath & lockRootAttrPath,
     CopyMode copyMode)
 {
     // Fetch a lazy tree first.
-    auto [accessor, resolvedRef, lockedRef] = fetchOrSubstituteTree(
-        state, originalRef, useRegistries, flakeCache);
+    auto [accessor, resolvedInput, lockedInput] = getAccessorCached(
+        state, originalRef.input, useRegistries, inputCache);
+
+    auto resolvedRef = FlakeRef(std::move(resolvedInput), originalRef.subdir);
+    auto lockedRef = FlakeRef(std::move(lockedInput), originalRef.subdir);
 
     // Parse/eval flake.nix to get at the input.self attributes.
     auto flake = readFlake(state, originalRef, resolvedRef, lockedRef, {accessor}, lockRootAttrPath);
@@ -425,10 +429,10 @@ static Flake getFlake(
         debug("refetching input '%s' due to self attribute", newLockedRef);
         // FIXME: need to remove attrs that are invalidated by the changed input attrs, such as 'narHash'.
         newLockedRef.input.attrs.erase("narHash");
-        auto [accessor2, resolvedRef2, lockedRef2] = fetchOrSubstituteTree(
-            state, newLockedRef, false, flakeCache);
+        auto [accessor2, resolvedInput2, lockedInput2] = getAccessorCached(
+            state, newLockedRef.input, false, inputCache);
         accessor = accessor2;
-        lockedRef = lockedRef2;
+        lockedRef = FlakeRef(std::move(lockedInput2), newLockedRef.subdir);
     }
 
     // Re-parse flake.nix from the store.
@@ -440,8 +444,8 @@ static Flake getFlake(
 
 Flake getFlake(EvalState & state, const FlakeRef & originalRef, bool useRegistries, CopyMode copyMode)
 {
-    FlakeCache flakeCache;
-    return getFlake(state, originalRef, useRegistries, flakeCache, {}, copyMode);
+    InputCache inputCache;
+    return getFlake(state, originalRef, useRegistries, inputCache, {}, copyMode);
 }
 
 static LockFile readLockFile(
@@ -461,11 +465,11 @@ LockedFlake lockFlake(
     const FlakeRef & topRef,
     const LockFlags & lockFlags)
 {
-    FlakeCache flakeCache;
+    InputCache inputCache;
 
     auto useRegistries = lockFlags.useRegistries.value_or(settings.useRegistries);
 
-    auto flake = getFlake(state, topRef, useRegistries, flakeCache, {}, lockFlags.copyMode);
+    auto flake = getFlake(state, topRef, useRegistries, inputCache, {}, lockFlags.copyMode);
 
     if (lockFlags.applyNixConfig) {
         flake.config.apply(settings);
@@ -647,7 +651,7 @@ LockedFlake lockFlake(
                         if (auto resolvedPath = resolveRelativePath()) {
                             return readFlake(state, ref, ref, ref, *resolvedPath, inputAttrPath);
                         } else {
-                            return getFlake(state, ref, useRegistries, flakeCache, inputAttrPath, inputCopyMode);
+                            return getFlake(state, ref, useRegistries, inputCache, inputAttrPath, inputCopyMode);
                         }
                     };
 
@@ -795,8 +799,10 @@ LockedFlake lockFlake(
                                 if (auto resolvedPath = resolveRelativePath()) {
                                     return {*resolvedPath, *input.ref};
                                 } else {
-                                    auto [accessor, resolvedRef, lockedRef] = fetchOrSubstituteTree(
-                                        state, *input.ref, useRegistries, flakeCache);
+                                    auto [accessor, resolvedInput, lockedInput] = getAccessorCached(
+                                        state, input.ref->input, useRegistries, inputCache);
+
+                                    auto lockedRef = FlakeRef(std::move(lockedInput), input.ref->subdir);
 
                                     return {
                                         state.storePath(mountInput(state, lockedRef.input, input.ref->input, accessor, inputCopyMode)),

From 3bbf91770701bb6d6ad791755f0b997553b810cb Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 9 Apr 2025 22:11:36 +0200
Subject: [PATCH 12/30] Move the input cache into libfetchers

---
 src/libcmd/repl.cc                            |  3 ++
 .../include/nix/fetchers/input-cache.hh       | 22 +++++++++
 .../include/nix/fetchers/meson.build          |  1 +
 src/libfetchers/input-cache.cc                | 41 ++++++++++++++++
 src/libfetchers/meson.build                   |  1 +
 src/libflake/flake/flake.cc                   | 49 ++++++-------------
 6 files changed, 82 insertions(+), 35 deletions(-)
 create mode 100644 src/libfetchers/include/nix/fetchers/input-cache.hh
 create mode 100644 src/libfetchers/input-cache.cc

diff --git a/src/libcmd/repl.cc b/src/libcmd/repl.cc
index c5a95268b..3805942ce 100644
--- a/src/libcmd/repl.cc
+++ b/src/libcmd/repl.cc
@@ -28,6 +28,7 @@
 #include "nix/expr/print.hh"
 #include "nix/util/ref.hh"
 #include "nix/expr/value.hh"
+#include "nix/fetchers/input-cache.hh"
 
 #include "nix/util/strings.hh"
 
@@ -458,6 +459,7 @@ ProcessLineResult NixRepl::processLine(std::string line)
 
     else if (command == ":l" || command == ":load") {
         state->resetFileCache();
+        fetchers::InputCache::getCache()->clear();
         loadFile(arg);
     }
 
@@ -467,6 +469,7 @@ ProcessLineResult NixRepl::processLine(std::string line)
 
     else if (command == ":r" || command == ":reload") {
         state->resetFileCache();
+        fetchers::InputCache::getCache()->clear();
         reloadFiles();
     }
 
diff --git a/src/libfetchers/include/nix/fetchers/input-cache.hh b/src/libfetchers/include/nix/fetchers/input-cache.hh
new file mode 100644
index 000000000..62092baef
--- /dev/null
+++ b/src/libfetchers/include/nix/fetchers/input-cache.hh
@@ -0,0 +1,22 @@
+#include "fetchers.hh"
+
+namespace nix::fetchers {
+
+struct CachedInput
+{
+    Input lockedInput;
+    ref<SourceAccessor> accessor;
+};
+
+struct InputCache
+{
+    virtual std::optional<CachedInput> lookup(const Input & originalInput) const = 0;
+
+    virtual void upsert(Input key, CachedInput cachedInput) = 0;
+
+    virtual void clear() = 0;
+
+    static ref<InputCache> getCache();
+};
+
+}
diff --git a/src/libfetchers/include/nix/fetchers/meson.build b/src/libfetchers/include/nix/fetchers/meson.build
index 3a752d9cb..e6ddedd97 100644
--- a/src/libfetchers/include/nix/fetchers/meson.build
+++ b/src/libfetchers/include/nix/fetchers/meson.build
@@ -9,6 +9,7 @@ headers = files(
   'filtering-source-accessor.hh',
   'git-lfs-fetch.hh',
   'git-utils.hh',
+  'input-cache.hh',
   'registry.hh',
   'store-path-accessor.hh',
   'tarball.hh',
diff --git a/src/libfetchers/input-cache.cc b/src/libfetchers/input-cache.cc
new file mode 100644
index 000000000..44d33428d
--- /dev/null
+++ b/src/libfetchers/input-cache.cc
@@ -0,0 +1,41 @@
+#include "nix/fetchers/input-cache.hh"
+#include "nix/util/sync.hh"
+
+namespace nix::fetchers {
+
+struct InputCacheImpl : InputCache
+{
+    Sync<std::map<Input, CachedInput>> cache_;
+
+    std::optional<CachedInput> lookup(const Input & originalInput) const override
+    {
+        auto cache(cache_.readLock());
+        auto i = cache->find(originalInput);
+        if (i == cache->end())
+            return std::nullopt;
+        debug(
+            "mapping '%s' to previously seen input '%s' -> '%s",
+            originalInput.to_string(),
+            i->first.to_string(),
+            i->second.lockedInput.to_string());
+        return i->second;
+    }
+
+    void upsert(Input key, CachedInput cachedInput) override
+    {
+        cache_.lock()->insert_or_assign(std::move(key), std::move(cachedInput));
+    }
+
+    void clear() override
+    {
+        cache_.lock()->clear();
+    }
+};
+
+ref<InputCache> InputCache::getCache()
+{
+    static auto cache = make_ref<InputCacheImpl>();
+    return cache;
+}
+
+}
diff --git a/src/libfetchers/meson.build b/src/libfetchers/meson.build
index 6e7129f4c..321146ca4 100644
--- a/src/libfetchers/meson.build
+++ b/src/libfetchers/meson.build
@@ -44,6 +44,7 @@ sources = files(
   'git.cc',
   'github.cc',
   'indirect.cc',
+  'input-cache.cc',
   'mercurial.cc',
   'path.cc',
   'registry.cc',
diff --git a/src/libflake/flake/flake.cc b/src/libflake/flake/flake.cc
index 7f9fbab98..6214ca57d 100644
--- a/src/libflake/flake/flake.cc
+++ b/src/libflake/flake/flake.cc
@@ -15,6 +15,7 @@
 #include "nix/fetchers/fetch-to-store.hh"
 #include "nix/util/memory-source-accessor.hh"
 #include "nix/util/mounted-source-accessor.hh"
+#include "nix/fetchers/input-cache.hh"
 
 #include <nlohmann/json.hpp>
 
@@ -25,32 +26,14 @@ using namespace fetchers;
 
 namespace flake {
 
-struct CachedInput
-{
-    Input lockedInput;
-    ref<SourceAccessor> accessor;
-};
-
-typedef std::map<Input, CachedInput> InputCache;
-
-static std::optional<CachedInput> lookupInInputCache(
-    const InputCache & inputCache,
-    const Input & originalInput)
-{
-    auto i = inputCache.find(originalInput);
-    if (i == inputCache.end()) return std::nullopt;
-    debug("mapping '%s' to previously seen input '%s' -> '%s",
-        originalInput.to_string(), i->first.to_string(), i->second.lockedInput.to_string());
-    return i->second;
-}
-
 static std::tuple<ref<SourceAccessor>, Input, Input> getAccessorCached(
     EvalState & state,
     const Input & originalInput,
-    bool useRegistries,
-    InputCache & inputCache)
+    bool useRegistries)
 {
-    auto fetched = lookupInInputCache(inputCache, originalInput);
+    auto inputCache = InputCache::getCache();
+
+    auto fetched = inputCache->lookup(originalInput);
     Input resolvedInput = originalInput;
 
     if (!fetched) {
@@ -66,18 +49,18 @@ static std::tuple<ref<SourceAccessor>, Input, Input> getAccessorCached(
                         return type == fetchers::Registry::Flag || type == fetchers::Registry::Global;
                     });
                 resolvedInput = std::move(res);
-                fetched = lookupInInputCache(inputCache, originalInput);
+                fetched = inputCache->lookup(resolvedInput);
                 if (!fetched) {
                     auto [accessor, lockedInput] = resolvedInput.getAccessor(state.store);
                     fetched.emplace(CachedInput{.lockedInput = lockedInput, .accessor = accessor});
                 }
-                inputCache.insert_or_assign(resolvedInput, *fetched);
+                inputCache->upsert(resolvedInput, *fetched);
             }
             else {
                 throw Error("'%s' is an indirect flake reference, but registry lookups are not allowed", originalInput.to_string());
             }
         }
-        inputCache.insert_or_assign(originalInput, *fetched);
+        inputCache->upsert(originalInput, *fetched);
     }
 
     debug("got tree '%s' from '%s'", fetched->accessor, fetched->lockedInput.to_string());
@@ -408,13 +391,12 @@ static Flake getFlake(
     EvalState & state,
     const FlakeRef & originalRef,
     bool useRegistries,
-    InputCache & inputCache,
     const InputAttrPath & lockRootAttrPath,
     CopyMode copyMode)
 {
     // Fetch a lazy tree first.
     auto [accessor, resolvedInput, lockedInput] = getAccessorCached(
-        state, originalRef.input, useRegistries, inputCache);
+        state, originalRef.input, useRegistries);
 
     auto resolvedRef = FlakeRef(std::move(resolvedInput), originalRef.subdir);
     auto lockedRef = FlakeRef(std::move(lockedInput), originalRef.subdir);
@@ -430,7 +412,7 @@ static Flake getFlake(
         // FIXME: need to remove attrs that are invalidated by the changed input attrs, such as 'narHash'.
         newLockedRef.input.attrs.erase("narHash");
         auto [accessor2, resolvedInput2, lockedInput2] = getAccessorCached(
-            state, newLockedRef.input, false, inputCache);
+            state, newLockedRef.input, false);
         accessor = accessor2;
         lockedRef = FlakeRef(std::move(lockedInput2), newLockedRef.subdir);
     }
@@ -444,8 +426,7 @@ static Flake getFlake(
 
 Flake getFlake(EvalState & state, const FlakeRef & originalRef, bool useRegistries, CopyMode copyMode)
 {
-    InputCache inputCache;
-    return getFlake(state, originalRef, useRegistries, inputCache, {}, copyMode);
+    return getFlake(state, originalRef, useRegistries, {}, copyMode);
 }
 
 static LockFile readLockFile(
@@ -465,11 +446,9 @@ LockedFlake lockFlake(
     const FlakeRef & topRef,
     const LockFlags & lockFlags)
 {
-    InputCache inputCache;
-
     auto useRegistries = lockFlags.useRegistries.value_or(settings.useRegistries);
 
-    auto flake = getFlake(state, topRef, useRegistries, inputCache, {}, lockFlags.copyMode);
+    auto flake = getFlake(state, topRef, useRegistries, {}, lockFlags.copyMode);
 
     if (lockFlags.applyNixConfig) {
         flake.config.apply(settings);
@@ -651,7 +630,7 @@ LockedFlake lockFlake(
                         if (auto resolvedPath = resolveRelativePath()) {
                             return readFlake(state, ref, ref, ref, *resolvedPath, inputAttrPath);
                         } else {
-                            return getFlake(state, ref, useRegistries, inputCache, inputAttrPath, inputCopyMode);
+                            return getFlake(state, ref, useRegistries, inputAttrPath, inputCopyMode);
                         }
                     };
 
@@ -800,7 +779,7 @@ LockedFlake lockFlake(
                                     return {*resolvedPath, *input.ref};
                                 } else {
                                     auto [accessor, resolvedInput, lockedInput] = getAccessorCached(
-                                        state, input.ref->input, useRegistries, inputCache);
+                                        state, input.ref->input, useRegistries);
 
                                     auto lockedRef = FlakeRef(std::move(lockedInput), input.ref->subdir);
 

From dd15c8a20d5d825723e720da300762d6f03f89a6 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 9 Apr 2025 23:06:03 +0200
Subject: [PATCH 13/30] Move getAccessorCached() to InputCache

Also, make fetchTree use InputCache.
---
 src/libexpr/primops/fetchTree.cc              |  8 +--
 .../include/nix/fetchers/input-cache.hh       | 21 ++++--
 src/libfetchers/input-cache.cc                | 40 +++++++++++
 src/libflake/flake/flake.cc                   | 67 +++----------------
 4 files changed, 70 insertions(+), 66 deletions(-)

diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index 424343ffc..c5cb70b44 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -10,6 +10,7 @@
 #include "nix/util/url.hh"
 #include "nix/expr/value-to-json.hh"
 #include "nix/fetchers/fetch-to-store.hh"
+#include "nix/fetchers/input-cache.hh"
 #include "nix/util/mounted-source-accessor.hh"
 
 #include <nlohmann/json.hpp>
@@ -201,16 +202,15 @@ static void fetchTree(
             throw Error("input '%s' is not allowed to use the '__final' attribute", input.to_string());
     }
 
-    // FIXME: use fetchOrSubstituteTree().
-    auto [accessor, lockedInput] = input.getAccessor(state.store);
+    auto cachedInput = fetchers::InputCache::getCache()->getAccessor(state.store, input, false);
 
     auto storePath = StorePath::random(input.getName());
 
     state.allowPath(storePath);
 
-    state.storeFS->mount(CanonPath(state.store->printStorePath(storePath)), accessor);
+    state.storeFS->mount(CanonPath(state.store->printStorePath(storePath)), cachedInput.accessor);
 
-    emitTreeAttrs(state, storePath, lockedInput, v, params.emptyRevFallback, false);
+    emitTreeAttrs(state, storePath, cachedInput.lockedInput, v, params.emptyRevFallback, false);
 }
 
 static void prim_fetchTree(EvalState & state, const PosIdx pos, Value * * args, Value & v)
diff --git a/src/libfetchers/include/nix/fetchers/input-cache.hh b/src/libfetchers/include/nix/fetchers/input-cache.hh
index 62092baef..6a7194741 100644
--- a/src/libfetchers/include/nix/fetchers/input-cache.hh
+++ b/src/libfetchers/include/nix/fetchers/input-cache.hh
@@ -2,14 +2,23 @@
 
 namespace nix::fetchers {
 
-struct CachedInput
-{
-    Input lockedInput;
-    ref<SourceAccessor> accessor;
-};
-
 struct InputCache
 {
+    struct CachedResult
+    {
+        ref<SourceAccessor> accessor;
+        Input resolvedInput;
+        Input lockedInput;
+    };
+
+    CachedResult getAccessor(ref<Store> store, const Input & originalInput, bool useRegistries);
+
+    struct CachedInput
+    {
+        Input lockedInput;
+        ref<SourceAccessor> accessor;
+    };
+
     virtual std::optional<CachedInput> lookup(const Input & originalInput) const = 0;
 
     virtual void upsert(Input key, CachedInput cachedInput) = 0;
diff --git a/src/libfetchers/input-cache.cc b/src/libfetchers/input-cache.cc
index 44d33428d..6772d67c7 100644
--- a/src/libfetchers/input-cache.cc
+++ b/src/libfetchers/input-cache.cc
@@ -1,8 +1,48 @@
 #include "nix/fetchers/input-cache.hh"
+#include "nix/fetchers/registry.hh"
 #include "nix/util/sync.hh"
+#include "nix/util/source-path.hh"
 
 namespace nix::fetchers {
 
+InputCache::CachedResult InputCache::getAccessor(ref<Store> store, const Input & originalInput, bool useRegistries)
+{
+    auto fetched = lookup(originalInput);
+    Input resolvedInput = originalInput;
+
+    if (!fetched) {
+        if (originalInput.isDirect()) {
+            auto [accessor, lockedInput] = originalInput.getAccessor(store);
+            fetched.emplace(CachedInput{.lockedInput = lockedInput, .accessor = accessor});
+        } else {
+            if (useRegistries) {
+                auto [res, extraAttrs] =
+                    lookupInRegistries(store, originalInput, [](fetchers::Registry::RegistryType type) {
+                        /* Only use the global registry and CLI flags
+                           to resolve indirect flakerefs. */
+                        return type == fetchers::Registry::Flag || type == fetchers::Registry::Global;
+                    });
+                resolvedInput = std::move(res);
+                fetched = lookup(resolvedInput);
+                if (!fetched) {
+                    auto [accessor, lockedInput] = resolvedInput.getAccessor(store);
+                    fetched.emplace(CachedInput{.lockedInput = lockedInput, .accessor = accessor});
+                }
+                upsert(resolvedInput, *fetched);
+            } else {
+                throw Error(
+                    "'%s' is an indirect flake reference, but registry lookups are not allowed",
+                    originalInput.to_string());
+            }
+        }
+        upsert(originalInput, *fetched);
+    }
+
+    debug("got tree '%s' from '%s'", fetched->accessor, fetched->lockedInput.to_string());
+
+    return {fetched->accessor, resolvedInput, fetched->lockedInput};
+}
+
 struct InputCacheImpl : InputCache
 {
     Sync<std::map<Input, CachedInput>> cache_;
diff --git a/src/libflake/flake/flake.cc b/src/libflake/flake/flake.cc
index 6214ca57d..34eab755a 100644
--- a/src/libflake/flake/flake.cc
+++ b/src/libflake/flake/flake.cc
@@ -26,48 +26,6 @@ using namespace fetchers;
 
 namespace flake {
 
-static std::tuple<ref<SourceAccessor>, Input, Input> getAccessorCached(
-    EvalState & state,
-    const Input & originalInput,
-    bool useRegistries)
-{
-    auto inputCache = InputCache::getCache();
-
-    auto fetched = inputCache->lookup(originalInput);
-    Input resolvedInput = originalInput;
-
-    if (!fetched) {
-        if (originalInput.isDirect()) {
-            auto [accessor, lockedInput] = originalInput.getAccessor(state.store);
-            fetched.emplace(CachedInput{.lockedInput = lockedInput, .accessor = accessor});
-        } else {
-            if (useRegistries) {
-                auto [res, extraAttrs] = lookupInRegistries(state.store, originalInput,
-                    [](fetchers::Registry::RegistryType type) {
-                        /* Only use the global registry and CLI flags
-                           to resolve indirect flakerefs. */
-                        return type == fetchers::Registry::Flag || type == fetchers::Registry::Global;
-                    });
-                resolvedInput = std::move(res);
-                fetched = inputCache->lookup(resolvedInput);
-                if (!fetched) {
-                    auto [accessor, lockedInput] = resolvedInput.getAccessor(state.store);
-                    fetched.emplace(CachedInput{.lockedInput = lockedInput, .accessor = accessor});
-                }
-                inputCache->upsert(resolvedInput, *fetched);
-            }
-            else {
-                throw Error("'%s' is an indirect flake reference, but registry lookups are not allowed", originalInput.to_string());
-            }
-        }
-        inputCache->upsert(originalInput, *fetched);
-    }
-
-    debug("got tree '%s' from '%s'", fetched->accessor, fetched->lockedInput.to_string());
-
-    return {fetched->accessor, resolvedInput, fetched->lockedInput};
-}
-
 static StorePath mountInput(
     EvalState & state,
     fetchers::Input & input,
@@ -395,14 +353,13 @@ static Flake getFlake(
     CopyMode copyMode)
 {
     // Fetch a lazy tree first.
-    auto [accessor, resolvedInput, lockedInput] = getAccessorCached(
-        state, originalRef.input, useRegistries);
+    auto cachedInput = fetchers::InputCache::getCache()->getAccessor(state.store, originalRef.input, useRegistries);
 
-    auto resolvedRef = FlakeRef(std::move(resolvedInput), originalRef.subdir);
-    auto lockedRef = FlakeRef(std::move(lockedInput), originalRef.subdir);
+    auto resolvedRef = FlakeRef(std::move(cachedInput.resolvedInput), originalRef.subdir);
+    auto lockedRef = FlakeRef(std::move(cachedInput.lockedInput), originalRef.subdir);
 
     // Parse/eval flake.nix to get at the input.self attributes.
-    auto flake = readFlake(state, originalRef, resolvedRef, lockedRef, {accessor}, lockRootAttrPath);
+    auto flake = readFlake(state, originalRef, resolvedRef, lockedRef, {cachedInput.accessor}, lockRootAttrPath);
 
     // Re-fetch the tree if necessary.
     auto newLockedRef = applySelfAttrs(lockedRef, flake);
@@ -411,16 +368,15 @@ static Flake getFlake(
         debug("refetching input '%s' due to self attribute", newLockedRef);
         // FIXME: need to remove attrs that are invalidated by the changed input attrs, such as 'narHash'.
         newLockedRef.input.attrs.erase("narHash");
-        auto [accessor2, resolvedInput2, lockedInput2] = getAccessorCached(
-            state, newLockedRef.input, false);
-        accessor = accessor2;
-        lockedRef = FlakeRef(std::move(lockedInput2), newLockedRef.subdir);
+        auto cachedInput2 = fetchers::InputCache::getCache()->getAccessor(state.store, newLockedRef.input, useRegistries);
+        cachedInput.accessor = cachedInput2.accessor;
+        lockedRef = FlakeRef(std::move(cachedInput2.lockedInput), newLockedRef.subdir);
     }
 
     // Re-parse flake.nix from the store.
     return readFlake(
         state, originalRef, resolvedRef, lockedRef,
-        state.storePath(mountInput(state, lockedRef.input, originalRef.input, accessor, copyMode)),
+        state.storePath(mountInput(state, lockedRef.input, originalRef.input, cachedInput.accessor, copyMode)),
         lockRootAttrPath);
 }
 
@@ -778,13 +734,12 @@ LockedFlake lockFlake(
                                 if (auto resolvedPath = resolveRelativePath()) {
                                     return {*resolvedPath, *input.ref};
                                 } else {
-                                    auto [accessor, resolvedInput, lockedInput] = getAccessorCached(
-                                        state, input.ref->input, useRegistries);
+                                    auto cachedInput = fetchers::InputCache::getCache()->getAccessor(state.store, input.ref->input, useRegistries);
 
-                                    auto lockedRef = FlakeRef(std::move(lockedInput), input.ref->subdir);
+                                    auto lockedRef = FlakeRef(std::move(cachedInput.lockedInput), input.ref->subdir);
 
                                     return {
-                                        state.storePath(mountInput(state, lockedRef.input, input.ref->input, accessor, inputCopyMode)),
+                                        state.storePath(mountInput(state, lockedRef.input, input.ref->input, cachedInput.accessor, inputCopyMode)),
                                         lockedRef
                                     };
                                 }

From 62565ce7cec2949a16ac5f8c03a2282ab6e5431b Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 10 Apr 2025 13:10:20 +0200
Subject: [PATCH 14/30] Remove unused variable

---
 src/libexpr/eval.cc | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index bb68e684c..d6e01c028 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -266,7 +266,6 @@ EvalState::EvalState(
                /nix/store while using a chroot store. */
             auto accessor = getFSSourceAccessor();
 
-            auto realStoreDir = dirOf(store->toRealPath(StorePath::dummy));
             accessor = settings.pureEval
                 ? storeFS.cast<SourceAccessor>()
                 : makeUnionSourceAccessor({accessor, storeFS});

From e099a5bc678a7bba0b2c99fbe667c08d4a7cc0f7 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 14 Apr 2025 14:29:14 +0200
Subject: [PATCH 15/30] Move the InputCache to EvalState

---
 src/libcmd/repl.cc                                  | 3 ---
 src/libexpr/eval.cc                                 | 3 +++
 src/libexpr/include/nix/expr/eval.hh                | 7 ++++++-
 src/libexpr/primops/fetchTree.cc                    | 2 +-
 src/libfetchers/include/nix/fetchers/input-cache.hh | 2 +-
 src/libfetchers/input-cache.cc                      | 5 ++---
 src/libflake/flake/flake.cc                         | 6 +++---
 7 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/src/libcmd/repl.cc b/src/libcmd/repl.cc
index 3805942ce..c5a95268b 100644
--- a/src/libcmd/repl.cc
+++ b/src/libcmd/repl.cc
@@ -28,7 +28,6 @@
 #include "nix/expr/print.hh"
 #include "nix/util/ref.hh"
 #include "nix/expr/value.hh"
-#include "nix/fetchers/input-cache.hh"
 
 #include "nix/util/strings.hh"
 
@@ -459,7 +458,6 @@ ProcessLineResult NixRepl::processLine(std::string line)
 
     else if (command == ":l" || command == ":load") {
         state->resetFileCache();
-        fetchers::InputCache::getCache()->clear();
         loadFile(arg);
     }
 
@@ -469,7 +467,6 @@ ProcessLineResult NixRepl::processLine(std::string line)
 
     else if (command == ":r" || command == ":reload") {
         state->resetFileCache();
-        fetchers::InputCache::getCache()->clear();
         reloadFiles();
     }
 
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index d6e01c028..0212162dd 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -20,6 +20,7 @@
 #include "nix/util/url.hh"
 #include "nix/fetchers/fetch-to-store.hh"
 #include "nix/fetchers/tarball.hh"
+#include "nix/fetchers/input-cache.hh"
 
 #include "parser-tab.hh"
 
@@ -290,6 +291,7 @@ EvalState::EvalState(
     )}
     , store(store)
     , buildStore(buildStore ? buildStore : store)
+    , inputCache(fetchers::InputCache::create())
     , debugRepl(nullptr)
     , debugStop(false)
     , trylevel(0)
@@ -1132,6 +1134,7 @@ void EvalState::resetFileCache()
 {
     fileEvalCache.clear();
     fileParseCache.clear();
+    inputCache->clear();
 }
 
 
diff --git a/src/libexpr/include/nix/expr/eval.hh b/src/libexpr/include/nix/expr/eval.hh
index 056fd98d3..505a7d1e7 100644
--- a/src/libexpr/include/nix/expr/eval.hh
+++ b/src/libexpr/include/nix/expr/eval.hh
@@ -33,7 +33,10 @@ namespace nix {
 constexpr size_t maxPrimOpArity = 8;
 
 class Store;
-namespace fetchers { struct Settings; }
+namespace fetchers {
+struct Settings;
+struct InputCache;
+}
 struct EvalSettings;
 class EvalState;
 class StorePath;
@@ -301,6 +304,8 @@ public:
 
     RootValue vImportedDrvToDerivation = nullptr;
 
+    ref<fetchers::InputCache> inputCache;
+
     /**
      * Debugger
      */
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index c5cb70b44..5d41d65c1 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -202,7 +202,7 @@ static void fetchTree(
             throw Error("input '%s' is not allowed to use the '__final' attribute", input.to_string());
     }
 
-    auto cachedInput = fetchers::InputCache::getCache()->getAccessor(state.store, input, false);
+    auto cachedInput = state.inputCache->getAccessor(state.store, input, false);
 
     auto storePath = StorePath::random(input.getName());
 
diff --git a/src/libfetchers/include/nix/fetchers/input-cache.hh b/src/libfetchers/include/nix/fetchers/input-cache.hh
index 6a7194741..a7ca34487 100644
--- a/src/libfetchers/include/nix/fetchers/input-cache.hh
+++ b/src/libfetchers/include/nix/fetchers/input-cache.hh
@@ -25,7 +25,7 @@ struct InputCache
 
     virtual void clear() = 0;
 
-    static ref<InputCache> getCache();
+    static ref<InputCache> create();
 };
 
 }
diff --git a/src/libfetchers/input-cache.cc b/src/libfetchers/input-cache.cc
index 6772d67c7..716143899 100644
--- a/src/libfetchers/input-cache.cc
+++ b/src/libfetchers/input-cache.cc
@@ -72,10 +72,9 @@ struct InputCacheImpl : InputCache
     }
 };
 
-ref<InputCache> InputCache::getCache()
+ref<InputCache> InputCache::create()
 {
-    static auto cache = make_ref<InputCacheImpl>();
-    return cache;
+    return make_ref<InputCacheImpl>();
 }
 
 }
diff --git a/src/libflake/flake/flake.cc b/src/libflake/flake/flake.cc
index 34eab755a..299a74640 100644
--- a/src/libflake/flake/flake.cc
+++ b/src/libflake/flake/flake.cc
@@ -353,7 +353,7 @@ static Flake getFlake(
     CopyMode copyMode)
 {
     // Fetch a lazy tree first.
-    auto cachedInput = fetchers::InputCache::getCache()->getAccessor(state.store, originalRef.input, useRegistries);
+    auto cachedInput = state.inputCache->getAccessor(state.store, originalRef.input, useRegistries);
 
     auto resolvedRef = FlakeRef(std::move(cachedInput.resolvedInput), originalRef.subdir);
     auto lockedRef = FlakeRef(std::move(cachedInput.lockedInput), originalRef.subdir);
@@ -368,7 +368,7 @@ static Flake getFlake(
         debug("refetching input '%s' due to self attribute", newLockedRef);
         // FIXME: need to remove attrs that are invalidated by the changed input attrs, such as 'narHash'.
         newLockedRef.input.attrs.erase("narHash");
-        auto cachedInput2 = fetchers::InputCache::getCache()->getAccessor(state.store, newLockedRef.input, useRegistries);
+        auto cachedInput2 = state.inputCache->getAccessor(state.store, newLockedRef.input, useRegistries);
         cachedInput.accessor = cachedInput2.accessor;
         lockedRef = FlakeRef(std::move(cachedInput2.lockedInput), newLockedRef.subdir);
     }
@@ -734,7 +734,7 @@ LockedFlake lockFlake(
                                 if (auto resolvedPath = resolveRelativePath()) {
                                     return {*resolvedPath, *input.ref};
                                 } else {
-                                    auto cachedInput = fetchers::InputCache::getCache()->getAccessor(state.store, input.ref->input, useRegistries);
+                                    auto cachedInput = state.inputCache->getAccessor(state.store, input.ref->input, useRegistries);
 
                                     auto lockedRef = FlakeRef(std::move(cachedInput.lockedInput), input.ref->subdir);
 

From 0c0dda3b297de33e810f177627bc2ff62de60704 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 15 Apr 2025 17:44:56 +0200
Subject: [PATCH 16/30] Devirtualize double-copied paths

Borrowed from the original lazy-trees branch.
---
 src/libexpr/eval.cc                  |  5 ++++-
 src/libexpr/include/nix/expr/eval.hh | 13 +++++++++++++
 src/libexpr/paths.cc                 | 15 +++++++++++++++
 src/libexpr/primops.cc               |  2 +-
 4 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 0212162dd..12b11f1ac 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -2317,6 +2317,9 @@ BackedStringView EvalState::coerceToString(
     }
 
     if (v.type() == nPath) {
+        // FIXME: instead of copying the path to the store, we could
+        // return a virtual store path that lazily copies the path to
+        // the store in devirtualize().
         return
             !canonicalizePath && !copyToStore
             ? // FIXME: hack to preserve path literals that end in a
@@ -2406,7 +2409,7 @@ StorePath EvalState::copyPathToStore(NixStringContext & context, const SourcePat
                 *store,
                 path.resolveSymlinks(SymlinkResolution::Ancestors),
                 settings.readOnlyMode ? FetchMode::DryRun : FetchMode::Copy,
-                path.baseName(),
+                computeBaseName(path),
                 ContentAddressMethod::Raw::NixArchive,
                 nullptr,
                 repair);
diff --git a/src/libexpr/include/nix/expr/eval.hh b/src/libexpr/include/nix/expr/eval.hh
index 505a7d1e7..3249b50a0 100644
--- a/src/libexpr/include/nix/expr/eval.hh
+++ b/src/libexpr/include/nix/expr/eval.hh
@@ -586,6 +586,19 @@ public:
 
     StorePath copyPathToStore(NixStringContext & context, const SourcePath & path);
 
+
+    /**
+     * Compute the base name for a `SourcePath`. For non-store paths,
+     * this is just `SourcePath::baseName()`. But for store paths, for
+     * backwards compatibility, it needs to be `<hash>-source`,
+     * i.e. as if the path were copied to the Nix store. This results
+     * in a "double-copied" store path like
+     * `/nix/store/<hash1>-<hash2>-source`. We don't need to
+     * materialize /nix/store/<hash2>-source though. Still, this
+     * requires reading/hashing the path twice.
+     */
+    std::string computeBaseName(const SourcePath & path);
+
     /**
      * Path coercion.
      *
diff --git a/src/libexpr/paths.cc b/src/libexpr/paths.cc
index f4c4de5fa..a27ebcae2 100644
--- a/src/libexpr/paths.cc
+++ b/src/libexpr/paths.cc
@@ -52,4 +52,19 @@ std::string EvalState::devirtualize(std::string_view s, const NixStringContext &
     return rewriteStrings(std::string(s), rewrites);
 }
 
+std::string EvalState::computeBaseName(const SourcePath & path)
+{
+    if (path.accessor == rootFS) {
+        if (auto storePath = store->maybeParseStorePath(path.path.abs())) {
+            warn(
+                "Performing inefficient double copy of path '%s' to the store. "
+                "This can typically be avoided by rewriting an attribute like `src = ./.` "
+                "to `src = builtins.path { path = ./.; name = \"source\"; }`.",
+                path);
+            return std::string(fetchToStore(*store, path, FetchMode::DryRun).to_string());
+        }
+    }
+    return std::string(path.baseName());
+}
+
 }
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 34677f9a3..7243f09ce 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -2539,7 +2539,7 @@ static void prim_filterSource(EvalState & state, const PosIdx pos, Value * * arg
         "while evaluating the second argument (the path to filter) passed to 'builtins.filterSource'");
     state.forceFunction(*args[0], pos, "while evaluating the first argument passed to builtins.filterSource");
 
-    addPath(state, pos, path.baseName(), path, args[0], ContentAddressMethod::Raw::NixArchive, std::nullopt, v, context);
+    addPath(state, pos, state.computeBaseName(path), path, args[0], ContentAddressMethod::Raw::NixArchive, std::nullopt, v, context);
 }
 
 static RegisterPrimOp primop_filterSource({

From 43a26916c25fff151698a1721793e0097251d07b Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 18 Apr 2025 16:01:19 +0200
Subject: [PATCH 17/30] unsafeGetAttrPos: Set string context on store paths

This is needed to devirtualize them when they get passed to a
derivation or builtins.toFile. Arguably, since this builtin is unsafe,
we could just ignore this, but we may as well do the correct thing.
---
 src/libexpr/eval.cc | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 12b11f1ac..b898d8ef5 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -948,7 +948,16 @@ void EvalState::mkPos(Value & v, PosIdx p)
     auto origin = positions.originOf(p);
     if (auto path = std::get_if<SourcePath>(&origin)) {
         auto attrs = buildBindings(3);
-        attrs.alloc(sFile).mkString(path->path.abs());
+        if (path->accessor == rootFS && store->isInStore(path->path.abs()))
+            // FIXME: only do this for virtual store paths?
+            attrs.alloc(sFile).mkString(path->path.abs(),
+                {
+                    NixStringContextElem::Opaque{
+                        .path = store->toStorePath(path->path.abs()).first
+                    }
+                });
+        else
+            attrs.alloc(sFile).mkString(path->path.abs());
         makePositionThunks(*this, p, attrs.alloc(sLine), attrs.alloc(sColumn));
         v.mkAttrs(attrs);
     } else

From ff85b347b8bde159d91938b6c5ee3eb62274e360 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 23 Apr 2025 12:27:25 +0200
Subject: [PATCH 18/30] Temporarily run all flake regression tests

---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 87a14b4bc..32ef50090 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -89,7 +89,7 @@ jobs:
                 | ".#hydraJobs.tests." + .')
 
   flake_regressions:
-    if: github.event_name == 'merge_group'
+    #if: github.event_name == 'merge_group'
     needs: build_x86_64-linux
     runs-on: blacksmith-32vcpu-ubuntu-2204
     steps:
@@ -109,7 +109,7 @@ jobs:
         with:
           determinate: true
       - uses: DeterminateSystems/flakehub-cache-action@main
-      - run: nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH MAX_FLAKES=50 flake-regressions/eval-all.sh
+      - run: nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH flake-regressions/eval-all.sh
 
   manual:
     if: github.event_name != 'merge_group'

From 182edb4dee637f37edfc1a027f1b95f30c66bc00 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 23 Apr 2025 13:52:22 +0200
Subject: [PATCH 19/30] Move mountInput into EvalState

---
 src/libexpr/include/nix/expr/eval.hh    | 10 +++++
 src/libexpr/paths.cc                    | 23 ++++++++++++
 src/libexpr/primops/fetchTree.cc        |  6 +--
 src/libflake/flake/flake.cc             | 50 ++++---------------------
 src/libflake/include/nix/flake/flake.hh | 11 +-----
 src/nix/flake.cc                        |  6 +--
 tests/functional/fetchGit.sh            |  2 +-
 7 files changed, 48 insertions(+), 60 deletions(-)

diff --git a/src/libexpr/include/nix/expr/eval.hh b/src/libexpr/include/nix/expr/eval.hh
index 3249b50a0..d82baddb1 100644
--- a/src/libexpr/include/nix/expr/eval.hh
+++ b/src/libexpr/include/nix/expr/eval.hh
@@ -36,6 +36,7 @@ class Store;
 namespace fetchers {
 struct Settings;
 struct InputCache;
+struct Input;
 }
 struct EvalSettings;
 class EvalState;
@@ -450,6 +451,15 @@ public:
 
     void checkURI(const std::string & uri);
 
+    /**
+     * Mount an input on the Nix store.
+     */
+    StorePath mountInput(
+        fetchers::Input & input,
+        const fetchers::Input & originalInput,
+        ref<SourceAccessor> accessor,
+        bool requireLockable);
+
     /**
      * Parse a Nix expression from the specified file.
      */
diff --git a/src/libexpr/paths.cc b/src/libexpr/paths.cc
index a27ebcae2..8e1c68e9a 100644
--- a/src/libexpr/paths.cc
+++ b/src/libexpr/paths.cc
@@ -67,4 +67,27 @@ std::string EvalState::computeBaseName(const SourcePath & path)
     return std::string(path.baseName());
 }
 
+StorePath EvalState::mountInput(
+    fetchers::Input & input, const fetchers::Input & originalInput, ref<SourceAccessor> accessor, bool requireLockable)
+{
+    auto storePath = StorePath::random(input.getName());
+
+    allowPath(storePath); // FIXME: should just whitelist the entire virtual store
+
+    storeFS->mount(CanonPath(store->printStorePath(storePath)), accessor);
+
+    if (requireLockable && !input.isLocked() && !input.getNarHash()) {
+        auto narHash = accessor->hashPath(CanonPath::root);
+        input.attrs.insert_or_assign("narHash", narHash.to_string(HashFormat::SRI, true));
+    }
+
+    // FIXME: check NAR hash
+
+#if 0
+    assert(!originalInput.getNarHash() || storePath == originalInput.computeStorePath(*store));
+#endif
+
+    return storePath;
+}
+
 }
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index 5d41d65c1..7dae30b6f 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -204,11 +204,7 @@ static void fetchTree(
 
     auto cachedInput = state.inputCache->getAccessor(state.store, input, false);
 
-    auto storePath = StorePath::random(input.getName());
-
-    state.allowPath(storePath);
-
-    state.storeFS->mount(CanonPath(state.store->printStorePath(storePath)), cachedInput.accessor);
+    auto storePath = state.mountInput(cachedInput.lockedInput, input, cachedInput.accessor, true);
 
     emitTreeAttrs(state, storePath, cachedInput.lockedInput, v, params.emptyRevFallback, false);
 }
diff --git a/src/libflake/flake/flake.cc b/src/libflake/flake/flake.cc
index 299a74640..2d3fd4e07 100644
--- a/src/libflake/flake/flake.cc
+++ b/src/libflake/flake/flake.cc
@@ -26,33 +26,6 @@ using namespace fetchers;
 
 namespace flake {
 
-static StorePath mountInput(
-    EvalState & state,
-    fetchers::Input & input,
-    const fetchers::Input & originalInput,
-    ref<SourceAccessor> accessor,
-    CopyMode copyMode)
-{
-    auto storePath = StorePath::random(input.getName());
-
-    state.allowPath(storePath); // FIXME: should just whitelist the entire virtual store
-
-    state.storeFS->mount(CanonPath(state.store->printStorePath(storePath)), accessor);
-
-    if (copyMode == CopyMode::RequireLockable && !input.isLocked() && !input.getNarHash()) {
-        auto narHash = accessor->hashPath(CanonPath::root);
-        input.attrs.insert_or_assign("narHash", narHash.to_string(HashFormat::SRI, true));
-    }
-
-    // FIXME: check NAR hash
-
-    #if 0
-    assert(!originalInput.getNarHash() || storePath == originalInput.computeStorePath(*state.store));
-    #endif
-
-    return storePath;
-}
-
 static void forceTrivialValue(EvalState & state, Value & value, const PosIdx pos)
 {
     if (value.isThunk() && value.isTrivial())
@@ -350,7 +323,7 @@ static Flake getFlake(
     const FlakeRef & originalRef,
     bool useRegistries,
     const InputAttrPath & lockRootAttrPath,
-    CopyMode copyMode)
+    bool requireLockable)
 {
     // Fetch a lazy tree first.
     auto cachedInput = state.inputCache->getAccessor(state.store, originalRef.input, useRegistries);
@@ -376,13 +349,13 @@ static Flake getFlake(
     // Re-parse flake.nix from the store.
     return readFlake(
         state, originalRef, resolvedRef, lockedRef,
-        state.storePath(mountInput(state, lockedRef.input, originalRef.input, cachedInput.accessor, copyMode)),
+        state.storePath(state.mountInput(lockedRef.input, originalRef.input, cachedInput.accessor, requireLockable)),
         lockRootAttrPath);
 }
 
-Flake getFlake(EvalState & state, const FlakeRef & originalRef, bool useRegistries, CopyMode copyMode)
+Flake getFlake(EvalState & state, const FlakeRef & originalRef, bool useRegistries, bool requireLockable)
 {
-    return getFlake(state, originalRef, useRegistries, {}, copyMode);
+    return getFlake(state, originalRef, useRegistries, {}, requireLockable);
 }
 
 static LockFile readLockFile(
@@ -404,7 +377,7 @@ LockedFlake lockFlake(
 {
     auto useRegistries = lockFlags.useRegistries.value_or(settings.useRegistries);
 
-    auto flake = getFlake(state, topRef, useRegistries, {}, lockFlags.copyMode);
+    auto flake = getFlake(state, topRef, useRegistries, {}, lockFlags.requireLockable);
 
     if (lockFlags.applyNixConfig) {
         flake.config.apply(settings);
@@ -449,13 +422,6 @@ LockedFlake lockFlake(
             explicitCliOverrides.insert(i.first);
         }
 
-        /* For locking of inputs, we require at least a NAR
-           hash. I.e. we can't be fully lazy. */
-        auto inputCopyMode =
-            lockFlags.copyMode == CopyMode::Lazy
-            ? CopyMode::RequireLockable
-            : lockFlags.copyMode;
-
         LockFile newLockFile;
 
         std::vector<FlakeRef> parents;
@@ -586,7 +552,7 @@ LockedFlake lockFlake(
                         if (auto resolvedPath = resolveRelativePath()) {
                             return readFlake(state, ref, ref, ref, *resolvedPath, inputAttrPath);
                         } else {
-                            return getFlake(state, ref, useRegistries, inputAttrPath, inputCopyMode);
+                            return getFlake(state, ref, useRegistries, inputAttrPath, true);
                         }
                     };
 
@@ -739,7 +705,7 @@ LockedFlake lockFlake(
                                     auto lockedRef = FlakeRef(std::move(cachedInput.lockedInput), input.ref->subdir);
 
                                     return {
-                                        state.storePath(mountInput(state, lockedRef.input, input.ref->input, cachedInput.accessor, inputCopyMode)),
+                                        state.storePath(state.mountInput(lockedRef.input, input.ref->input, cachedInput.accessor, true)),
                                         lockedRef
                                     };
                                 }
@@ -851,7 +817,7 @@ LockedFlake lockFlake(
                            repo, so we should re-read it. FIXME: we could
                            also just clear the 'rev' field... */
                         auto prevLockedRef = flake.lockedRef;
-                        flake = getFlake(state, topRef, useRegistries, lockFlags.copyMode);
+                        flake = getFlake(state, topRef, useRegistries, lockFlags.requireLockable);
 
                         if (lockFlags.commitLockFile &&
                             flake.lockedRef.input.getRev() &&
diff --git a/src/libflake/include/nix/flake/flake.hh b/src/libflake/include/nix/flake/flake.hh
index 35398a306..1dd55d107 100644
--- a/src/libflake/include/nix/flake/flake.hh
+++ b/src/libflake/include/nix/flake/flake.hh
@@ -115,18 +115,11 @@ struct Flake
     }
 };
 
-enum struct CopyMode {
-    //! Ensure that the input is locked or has a NAR hash.
-    RequireLockable,
-    //! Just return a lazy source accessor.
-    Lazy,
-};
-
 Flake getFlake(
     EvalState & state,
     const FlakeRef & flakeRef,
     bool useRegistries,
-    CopyMode copyMode = CopyMode::RequireLockable);
+    bool requireLockable = true);
 
 /**
  * Fingerprint of a locked flake; used as a cache key.
@@ -228,7 +221,7 @@ struct LockFlags
     /**
      * Whether to require a locked input.
      */
-    CopyMode copyMode = CopyMode::RequireLockable;
+    bool requireLockable = true;
 };
 
 LockedFlake lockFlake(
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 26626b020..9f63fabc4 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -134,7 +134,7 @@ public:
         lockFlags.recreateLockFile = updateAll;
         lockFlags.writeLockFile = true;
         lockFlags.applyNixConfig = true;
-        lockFlags.copyMode = CopyMode::Lazy;
+        lockFlags.requireLockable = false;
 
         lockFlake();
     }
@@ -167,7 +167,7 @@ struct CmdFlakeLock : FlakeCommand
         lockFlags.writeLockFile = true;
         lockFlags.failOnUnlocked = true;
         lockFlags.applyNixConfig = true;
-        lockFlags.copyMode = CopyMode::Lazy;
+        lockFlags.requireLockable = false;
 
         lockFlake();
     }
@@ -214,7 +214,7 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
 
     void run(nix::ref<nix::Store> store) override
     {
-        lockFlags.copyMode = CopyMode::Lazy;
+        lockFlags.requireLockable = false;
         auto lockedFlake = lockFlake();
         auto & flake = lockedFlake.flake;
 
diff --git a/tests/functional/fetchGit.sh b/tests/functional/fetchGit.sh
index 283833e58..baa09b60b 100755
--- a/tests/functional/fetchGit.sh
+++ b/tests/functional/fetchGit.sh
@@ -303,7 +303,7 @@ echo foo > "$empty/x"
 
 git -C "$empty" add x
 
-[[ $(nix eval --impure --expr "builtins.removeAttrs (builtins.fetchGit $empty) [\"outPath\"]") = '{ lastModified = 0; lastModifiedDate = "19700101000000"; rev = "0000000000000000000000000000000000000000"; revCount = 0; shortRev = "0000000"; submodules = false; }' ]]
+[[ $(nix eval --impure --expr "builtins.removeAttrs (builtins.fetchGit $empty) [\"outPath\"]") = '{ lastModified = 0; lastModifiedDate = "19700101000000"; narHash = "sha256-wzlAGjxKxpaWdqVhlq55q5Gxo4Bf860+kLeEa/v02As="; rev = "0000000000000000000000000000000000000000"; revCount = 0; shortRev = "0000000"; submodules = false; }' ]]
 
 # Test a repo with an empty commit.
 git -C "$empty" rm -f x

From 9d87ab1dc8b3e200c01e04e5fb6c8381b9a04301 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 24 Apr 2025 16:03:49 +0200
Subject: [PATCH 20/30] Add a setting to enable lazy trees

---
 src/libexpr/include/nix/expr/eval-settings.hh |  5 +++++
 src/libexpr/paths.cc                          | 11 +++++------
 tests/functional/flakes/flakes.sh             |  3 ++-
 tests/functional/flakes/unlocked-override.sh  |  3 ++-
 4 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/src/libexpr/include/nix/expr/eval-settings.hh b/src/libexpr/include/nix/expr/eval-settings.hh
index fb482568a..6e5bbca20 100644
--- a/src/libexpr/include/nix/expr/eval-settings.hh
+++ b/src/libexpr/include/nix/expr/eval-settings.hh
@@ -247,6 +247,11 @@ struct EvalSettings : Config
 
           This option can be enabled by setting `NIX_ABORT_ON_WARN=1` in the environment.
         )"};
+
+    Setting<bool> lazyTrees{this, false, "lazy-trees",
+        R"(
+          If set to true, flakes and trees fetched by [`builtins.fetchTree`](@docroot@/language/builtins.md#builtins-fetchTree) are only copied to the Nix store when they're used as a dependency of a derivation. This avoids copying (potentially large) source trees unnecessarily.
+        )"};
 };
 
 /**
diff --git a/src/libexpr/paths.cc b/src/libexpr/paths.cc
index 8e1c68e9a..451962636 100644
--- a/src/libexpr/paths.cc
+++ b/src/libexpr/paths.cc
@@ -70,7 +70,8 @@ std::string EvalState::computeBaseName(const SourcePath & path)
 StorePath EvalState::mountInput(
     fetchers::Input & input, const fetchers::Input & originalInput, ref<SourceAccessor> accessor, bool requireLockable)
 {
-    auto storePath = StorePath::random(input.getName());
+    auto storePath = settings.lazyTrees ? StorePath::random(input.getName())
+                                        : fetchToStore(*store, accessor, FetchMode::Copy, input.getName());
 
     allowPath(storePath); // FIXME: should just whitelist the entire virtual store
 
@@ -81,11 +82,9 @@ StorePath EvalState::mountInput(
         input.attrs.insert_or_assign("narHash", narHash.to_string(HashFormat::SRI, true));
     }
 
-    // FIXME: check NAR hash
-
-#if 0
-    assert(!originalInput.getNarHash() || storePath == originalInput.computeStorePath(*store));
-#endif
+    // FIXME: what to do with the NAR hash in lazy mode?
+    if (!settings.lazyTrees)
+        assert(!originalInput.getNarHash() || storePath == originalInput.computeStorePath(*store));
 
     return storePath;
 }
diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
index 0fcdf0b30..c8cd5f138 100755
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -75,7 +75,8 @@ hash1=$(echo "$json" | jq -r .revision)
 
 echo foo > "$flake1Dir/foo"
 git -C "$flake1Dir" add $flake1Dir/foo
-[[ $(_NIX_TEST_FAIL_ON_LARGE_PATH=1 nix flake metadata flake1 --json --refresh --warn-large-path-threshold 1 | jq -r .dirtyRevision) == "$hash1-dirty" ]]
+[[ $(nix flake metadata flake1 --json --refresh | jq -r .dirtyRevision) == "$hash1-dirty" ]]
+#[[ $(_NIX_TEST_FAIL_ON_LARGE_PATH=1 nix flake metadata flake1 --json --refresh --warn-large-path-threshold 1 | jq -r .dirtyRevision) == "$hash1-dirty" ]]
 [[ "$(nix flake metadata flake1 --json | jq -r .fingerprint)" != null ]]
 
 echo -n '# foo' >> "$flake1Dir/flake.nix"
diff --git a/tests/functional/flakes/unlocked-override.sh b/tests/functional/flakes/unlocked-override.sh
index 9d8d569f1..73784b4e8 100755
--- a/tests/functional/flakes/unlocked-override.sh
+++ b/tests/functional/flakes/unlocked-override.sh
@@ -35,7 +35,8 @@ echo 456 > "$flake1Dir"/x.nix
 expectStderr 1 nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/flake1" |
   grepQuiet "Will not write lock file.*because it has an unlocked input"
 
-_NIX_TEST_FAIL_ON_LARGE_PATH=1 nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/flake1" --allow-dirty-locks --warn-large-path-threshold 1
+nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/flake1" --allow-dirty-locks
+#_NIX_TEST_FAIL_ON_LARGE_PATH=1 nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/flake1" --allow-dirty-locks --warn-large-path-threshold 1
 
 # Using a lock file with a dirty lock does not require --allow-dirty-locks, but should print a warning.
 expectStderr 0 nix eval "$flake2Dir#x" |

From 2aa36551660b78bb70b9910fd524909298f3cf19 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 24 Apr 2025 17:08:33 +0200
Subject: [PATCH 21/30] computeBaseName(): Respect the original store path name

---
 src/libexpr/paths.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libexpr/paths.cc b/src/libexpr/paths.cc
index 451962636..826a738a6 100644
--- a/src/libexpr/paths.cc
+++ b/src/libexpr/paths.cc
@@ -61,7 +61,7 @@ std::string EvalState::computeBaseName(const SourcePath & path)
                 "This can typically be avoided by rewriting an attribute like `src = ./.` "
                 "to `src = builtins.path { path = ./.; name = \"source\"; }`.",
                 path);
-            return std::string(fetchToStore(*store, path, FetchMode::DryRun).to_string());
+            return std::string(fetchToStore(*store, path, FetchMode::DryRun, storePath->name()).to_string());
         }
     }
     return std::string(path.baseName());

From 88cd82239e81687d67fad72541f71fefa494b56d Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 25 Apr 2025 16:50:02 +0200
Subject: [PATCH 22/30] Fix the nix-community/patsh/0.2.1 flake regression test
 (again)

---
 src/libfetchers/fetchers.cc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/libfetchers/fetchers.cc b/src/libfetchers/fetchers.cc
index 9693f1773..33301933c 100644
--- a/src/libfetchers/fetchers.cc
+++ b/src/libfetchers/fetchers.cc
@@ -228,6 +228,9 @@ void Input::checkLocks(Input specified, Input & result)
         if (auto prevNarHash = specified.getNarHash())
             specified.attrs.insert_or_assign("narHash", prevNarHash->to_string(HashFormat::SRI, true));
 
+        if (auto narHash = result.getNarHash())
+            result.attrs.insert_or_assign("narHash", narHash->to_string(HashFormat::SRI, true));
+
         for (auto & field : specified.attrs) {
             auto field2 = result.attrs.find(field.first);
             if (field2 != result.attrs.end() && field.second != field2->second)

From ae5ac8acc115de6235aeba97c5912e0fb142f14f Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 25 Apr 2025 21:39:05 +0200
Subject: [PATCH 23/30] Limit parallelism

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 32ef50090..9df6b00a5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -109,7 +109,7 @@ jobs:
         with:
           determinate: true
       - uses: DeterminateSystems/flakehub-cache-action@main
-      - run: nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH flake-regressions/eval-all.sh
+      - run: lscpu && nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH PARALLEL="-P 16" flake-regressions/eval-all.sh
 
   manual:
     if: github.event_name != 'merge_group'

From fef193fbc4fa83abdb82db91cf4c79cff41f5f17 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 6 May 2025 18:42:32 +0200
Subject: [PATCH 24/30] Try namespace runner

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9df6b00a5..b3efeca79 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -91,7 +91,7 @@ jobs:
   flake_regressions:
     #if: github.event_name == 'merge_group'
     needs: build_x86_64-linux
-    runs-on: blacksmith-32vcpu-ubuntu-2204
+    runs-on: namespace-profile-x86-32cpu-64gb
     steps:
       - name: Checkout nix
         uses: actions/checkout@v4

From 6f5cfafe0d5f62a9f554b236db09ef7762396988 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 6 May 2025 19:11:49 +0200
Subject: [PATCH 25/30] Run flake-regressions with --lazy-trees

---
 .github/workflows/ci.yml | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b3efeca79..0bb4083fb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -109,7 +109,30 @@ jobs:
         with:
           determinate: true
       - uses: DeterminateSystems/flakehub-cache-action@main
-      - run: lscpu && nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH PARALLEL="-P 16" flake-regressions/eval-all.sh
+      - run: lscpu && nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH PARALLEL="-P 50%" flake-regressions/eval-all.sh
+
+  flake_regressions_lazy:
+    #if: github.event_name == 'merge_group'
+    needs: build_x86_64-linux
+    runs-on: namespace-profile-x86-32cpu-64gb
+    steps:
+      - name: Checkout nix
+        uses: actions/checkout@v4
+      - name: Checkout flake-regressions
+        uses: actions/checkout@v4
+        with:
+          repository: DeterminateSystems/flake-regressions
+          path: flake-regressions
+      - name: Checkout flake-regressions-data
+        uses: actions/checkout@v4
+        with:
+          repository: DeterminateSystems/flake-regressions-data
+          path: flake-regressions/tests
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          determinate: true
+      - uses: DeterminateSystems/flakehub-cache-action@main
+      - run: lscpu && nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH PARALLEL="-P 50%" NIX_CONFIG="lazy-trees = true" flake-regressions/eval-all.sh
 
   manual:
     if: github.event_name != 'merge_group'

From 630bdff7e9d9d1585d61d3b5f2ceb24e553708fb Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 7 May 2025 12:49:11 +0200
Subject: [PATCH 26/30] Re-enable _NIX_TEST_FAIL_ON_LARGE_PATH tests

---
 tests/functional/flakes/flakes.sh            | 2 +-
 tests/functional/flakes/unlocked-override.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
index 78ad833e5..611e8626d 100755
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -76,7 +76,7 @@ hash1=$(echo "$json" | jq -r .revision)
 echo foo > "$flake1Dir/foo"
 git -C "$flake1Dir" add $flake1Dir/foo
 [[ $(nix flake metadata flake1 --json --refresh | jq -r .dirtyRevision) == "$hash1-dirty" ]]
-#[[ $(_NIX_TEST_FAIL_ON_LARGE_PATH=1 nix flake metadata flake1 --json --refresh --warn-large-path-threshold 1 | jq -r .dirtyRevision) == "$hash1-dirty" ]]
+[[ $(_NIX_TEST_FAIL_ON_LARGE_PATH=1 nix flake metadata flake1 --json --refresh --warn-large-path-threshold 1 --lazy-trees | jq -r .dirtyRevision) == "$hash1-dirty" ]]
 [[ "$(nix flake metadata flake1 --json | jq -r .fingerprint)" != null ]]
 
 echo -n '# foo' >> "$flake1Dir/flake.nix"
diff --git a/tests/functional/flakes/unlocked-override.sh b/tests/functional/flakes/unlocked-override.sh
index 73784b4e8..bd73929dc 100755
--- a/tests/functional/flakes/unlocked-override.sh
+++ b/tests/functional/flakes/unlocked-override.sh
@@ -36,7 +36,7 @@ expectStderr 1 nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/f
   grepQuiet "Will not write lock file.*because it has an unlocked input"
 
 nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/flake1" --allow-dirty-locks
-#_NIX_TEST_FAIL_ON_LARGE_PATH=1 nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/flake1" --allow-dirty-locks --warn-large-path-threshold 1
+_NIX_TEST_FAIL_ON_LARGE_PATH=1 nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/flake1" --allow-dirty-locks --warn-large-path-threshold 1 --lazy-trees
 
 # Using a lock file with a dirty lock does not require --allow-dirty-locks, but should print a warning.
 expectStderr 0 nix eval "$flake2Dir#x" |

From 91cde8c79d318a1adb0f2e3dfa8670e4964ff3b4 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 7 May 2025 13:31:04 +0200
Subject: [PATCH 27/30] EvalState::mountInput(): Throw an error if there is a
 NAR hash mismatch

---
 src/libexpr/paths.cc         | 12 ++++++++++--
 tests/functional/fetchGit.sh |  5 ++---
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/src/libexpr/paths.cc b/src/libexpr/paths.cc
index 826a738a6..da1408e9b 100644
--- a/src/libexpr/paths.cc
+++ b/src/libexpr/paths.cc
@@ -83,8 +83,16 @@ StorePath EvalState::mountInput(
     }
 
     // FIXME: what to do with the NAR hash in lazy mode?
-    if (!settings.lazyTrees)
-        assert(!originalInput.getNarHash() || storePath == originalInput.computeStorePath(*store));
+    if (!settings.lazyTrees && originalInput.getNarHash()) {
+        auto expected = originalInput.computeStorePath(*store);
+        if (storePath != expected)
+            throw Error(
+                (unsigned int) 102,
+                "NAR hash mismatch in input '%s', expected '%s' but got '%s'",
+                originalInput.to_string(),
+                store->printStorePath(storePath),
+                store->printStorePath(expected));
+    }
 
     return storePath;
 }
diff --git a/tests/functional/fetchGit.sh b/tests/functional/fetchGit.sh
index baa09b60b..6fc8ca8b0 100755
--- a/tests/functional/fetchGit.sh
+++ b/tests/functional/fetchGit.sh
@@ -142,14 +142,13 @@ path4=$(nix eval --impure --refresh --raw --expr "(builtins.fetchGit file://$rep
 [[ $(nix eval --impure --expr "builtins.hasAttr \"dirtyRev\" (builtins.fetchGit $repo)") == "false" ]]
 [[ $(nix eval --impure --expr "builtins.hasAttr \"dirtyShortRev\" (builtins.fetchGit $repo)") == "false" ]]
 
-# FIXME: check narHash
-#expect 102 nix eval --raw --expr "(builtins.fetchGit { url = $repo; rev = \"$rev2\"; narHash = \"sha256-B5yIPHhEm0eysJKEsO7nqxprh9vcblFxpJG11gXJus1=\"; }).outPath"
+expect 102 nix eval --raw --expr "(builtins.fetchGit { url = $repo; rev = \"$rev2\"; narHash = \"sha256-B5yIPHhEm0eysJKEsO7nqxprh9vcblFxpJG11gXJus1=\"; }).outPath"
 
 path5=$(nix eval --raw --expr "(builtins.fetchGit { url = $repo; rev = \"$rev2\"; narHash = \"sha256-Hr8g6AqANb3xqX28eu1XnjK/3ab8Gv6TJSnkb1LezG9=\"; }).outPath")
 [[ $path = $path5 ]]
 
 # Ensure that NAR hashes are checked.
-#expectStderr 102 nix eval --raw --expr "(builtins.fetchGit { url = $repo; rev = \"$rev2\"; narHash = \"sha256-Hr8g6AqANb4xqX28eu1XnjK/3ab8Gv6TJSnkb1LezG9=\"; }).outPath" | grepQuiet "error: NAR hash mismatch"
+expectStderr 102 nix eval --raw --expr "(builtins.fetchGit { url = $repo; rev = \"$rev2\"; narHash = \"sha256-Hr8g6AqANb4xqX28eu1XnjK/3ab8Gv6TJSnkb1LezG9=\"; }).outPath" | grepQuiet "error: NAR hash mismatch"
 
 # It's allowed to use only a narHash, but you should get a warning.
 expectStderr 0 nix eval --raw --expr "(builtins.fetchGit { url = $repo; ref = \"tag2\"; narHash = \"sha256-Hr8g6AqANb3xqX28eu1XnjK/3ab8Gv6TJSnkb1LezG9=\"; }).outPath" | grepQuiet "warning: Input .* is unlocked"

From 9bab483196e79d66fbb7527f6f68816632931c45 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 7 May 2025 13:37:36 +0200
Subject: [PATCH 28/30] Improve error message

Co-authored-by: Cole Helbling <cole.e.helbling@outlook.com>
---
 src/libexpr/eval.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index b898d8ef5..6505de7bc 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -2473,7 +2473,7 @@ StorePath EvalState::coerceToStorePath(const PosIdx pos, Value & v, NixStringCon
     auto path = coerceToString(pos, v, context, errorCtx, false, false, true).toOwned();
     if (auto storePath = store->maybeParseStorePath(path))
         return *storePath;
-    error<EvalError>("cannot coerce '%s' to a store path because it does not denote a subpath of the Nix store", path).withTrace(pos, errorCtx).debugThrow();
+    error<EvalError>("cannot coerce '%s' to a store path because it is not a subpath of the Nix store", path).withTrace(pos, errorCtx).debugThrow();
 }
 
 

From d0a89fa03fbfef6ee32485fb39a1844a1cb9c4f6 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 7 May 2025 15:30:13 +0200
Subject: [PATCH 29/30] Put flake_regressions back in the merge queue

---
 .github/workflows/ci.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0bb4083fb..13d911518 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -89,7 +89,7 @@ jobs:
                 | ".#hydraJobs.tests." + .')
 
   flake_regressions:
-    #if: github.event_name == 'merge_group'
+    if: github.event_name == 'merge_group'
     needs: build_x86_64-linux
     runs-on: namespace-profile-x86-32cpu-64gb
     steps:
@@ -109,10 +109,10 @@ jobs:
         with:
           determinate: true
       - uses: DeterminateSystems/flakehub-cache-action@main
-      - run: lscpu && nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH PARALLEL="-P 50%" flake-regressions/eval-all.sh
+      - run: nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH PARALLEL="-P 50%" flake-regressions/eval-all.sh
 
   flake_regressions_lazy:
-    #if: github.event_name == 'merge_group'
+    if: github.event_name == 'merge_group'
     needs: build_x86_64-linux
     runs-on: namespace-profile-x86-32cpu-64gb
     steps:
@@ -132,7 +132,7 @@ jobs:
         with:
           determinate: true
       - uses: DeterminateSystems/flakehub-cache-action@main
-      - run: lscpu && nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH PARALLEL="-P 50%" NIX_CONFIG="lazy-trees = true" flake-regressions/eval-all.sh
+      - run: nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH PARALLEL="-P 50%" NIX_CONFIG="lazy-trees = true" flake-regressions/eval-all.sh
 
   manual:
     if: github.event_name != 'merge_group'

From f6ad6291ab17048146af88695cb732c70fcc4481 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 7 May 2025 15:56:35 +0200
Subject: [PATCH 30/30] nix flake metadata: Show store path if available

---
 src/nix/flake.cc                  | 8 ++++++--
 tests/functional/flakes/flakes.sh | 1 +
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 9f63fabc4..4782cbb29 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -218,9 +218,13 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
         auto lockedFlake = lockFlake();
         auto & flake = lockedFlake.flake;
 
+        /* Hack to show the store path if available. */
         std::optional<StorePath> storePath;
-        if (flake.lockedRef.input.getNarHash())
-            storePath = flake.lockedRef.input.computeStorePath(*store);
+        if (store->isInStore(flake.path.path.abs())) {
+            auto path = store->toStorePath(flake.path.path.abs()).first;
+            if (store->isValidPath(path))
+                storePath = path;
+        }
 
         if (json) {
             nlohmann::json j;
diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
index 611e8626d..7ec438d74 100755
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -69,6 +69,7 @@ nix flake metadata "$flake1Dir" | grepQuiet 'URL:.*flake1.*'
 # Test 'nix flake metadata --json'.
 json=$(nix flake metadata flake1 --json | jq .)
 [[ $(echo "$json" | jq -r .description) = 'Bla bla' ]]
+[[ -d $(echo "$json" | jq -r .path) ]]
 [[ $(echo "$json" | jq -r .lastModified) = $(git -C "$flake1Dir" log -n1 --format=%ct) ]]
 hash1=$(echo "$json" | jq -r .revision)
 [[ -n $(echo "$json" | jq -r .fingerprint) ]]