Nix Derivation Anatomy

Nix treats package names as structural; authors treat them as cosmetic.

Lazy evaluation lets Nix defer work to scale, but correctness errors can hide until triggered.

Flakes need a way to tell tools about custom outputs beyond packages and shells.

Nix's.drv files provide the complete, tamper-evident dependency record SBOMs actually need.

Content-addressed paths let Nix skip rebuilds and verify outputs without trusting the cache.

Nix scans binaries to automatically detect dependencies, guaranteeing complete closure graphs.

How Nix's two addressing models determine what store paths actually promise.

Nix's reproducibility guarantee has a blind spot that breaks supply chain integrity on purpose.