Nix: v2.2.0 build fails with node_modules hash mismatch #59882

Activity

1. opencodejr commented on Oct 28, 2026

   

   opencodejrBot

   on Oct 28, 2026

   Contributor

   More actions

   Thanks for the report. I could reproduce the hash mismatch on dev, but not on the v2.2.0 tag itself.

   I used Nix 2.35.4 on x86_64-linux, building with the flake's own flake.lock (no inputs.nixpkgs.follows):

   • v2.2.0 (1097e26): nix build .#opencode.node_modules succeeds with the pinned hash. The full nix build .#opencode also succeeds and reports opencode v2.2.0+1097e26.
   • Latest dev (950111f): nix build .#opencode.node_modules fails with exactly your hashes (specified: sha256-WTBGUXIj…, got: sha256-I3JJjXdM…). nix/hashes.json on dev is stale. The hash-bot PR chore: update nix node_modules hashes #59827, still open, is meant to update it.

   The script below runs both builds.

   If your CI fails on the v2.2.0 tag, does your flake set inputs.opencode.inputs.nixpkgs.follows? A different nixpkgs brings a different bun version, which changes the node_modules hash (#49063). That would explain a mismatch on the release even when the pinned hash is correct for the flake's own inputs.

   Related:

   • fix(nix): verify dependency hashes before releases #59881: your PR to build dependencies in PR checks and before releases
   • nix-eval never builds, so a broken Nix derivation can merge into v2 undetected #52863: Nix CI only evaluates derivations and never builds them
   • node_modules FOD hash is calibrated against one bun version — breaks with any other #49063: the node_modules hash depends on the bun version
   • opencode desktop 2.2.0 does not build on nixos (flake) #59601: the v2.2.0 desktop flake build fails, in a different step

   Reproduction script (repro.sh)

   #!/usr/bin/env bash
   # Reproduces #59882: the Nix node_modules fixed-output derivation hash in
   # nix/hashes.json is stale on `dev`, while the v2.2.0 tag builds fine.
   # Needs Nix with flakes enabled (nix-command flakes), x86_64-linux.
   set -u
   REPO=${REPO:-https://github.com/anomalyco/opencode}
   
   echo "== v2.2.0 tag (flake's own nixpkgs lock) =="
   nix build --no-link --print-build-logs "git+${REPO}?ref=refs/tags/v2.2.0#opencode.node_modules" 2>&1 | grep -iA2 "mismatch" \
     || echo "v2.2.0 node_modules: built OK with pinned hash"
   
   echo "== dev =="
   nix build --no-link --print-build-logs "git+${REPO}?ref=dev#opencode.node_modules" 2>&1 | grep -iA2 "mismatch" \
     || echo "dev node_modules: built OK with pinned hash"

   Run it: bash repro.sh
2. opencodejr

   added

   reproduced

   on Oct 28, 2026
3. clementpoiret commented on Nov 2, 2026

   

   clementpoiret

   on Nov 2, 2026

   Author

   More actions

   For context, il happens to nearly all releases, making opencode hard to install on NixOS using the flake. E.g., current v2.2.5 is also broken

   👍React with 👍3Reacted by Tamás Gulácsi, Valentin Delaye and skwig
4. mplibunao commented on Nov 2, 2026

   

   mplibunao

   on Nov 2, 2026

   More actions

   Also seeing this on aarch64-darwin (macOS 26.6.2, Determinate Nix 3.15.0 / Nix 2.33.0) with v2.2.3 and v2.2.5. I'm building from the tags with the flake's own lock, no follows:

   v2.2.3  specified: sha256-ie3dihmkL/U4kPw+hKyVNj8uryed9mxGEiq8VpxMMIc=
           got:       sha256-Uv2AFVqJHbAG2zlIEieSSUY616pyda9yxB4gUwFKYm0=
   v2.2.5  specified: sha256-rb8stm2Va+SkGrZXeCYDwFvrKtpsRnggQeBp5p8NPYY=
           got:       sha256-bp2jsa4iX5jX4O3vWQC9TRSwsAtnkzXX86O90NaJdq8=
   

   Looks like the same cause described above. The v2.2.5 tag still has the nix/hashes.json from 85d7397, and bun.lock changed in the 20 commits after that.

   Would it be possible to update the hashes before tagging a release? Then the tagged flake would build as-is. For now I'm overriding the node_modules hash locally.
5. clementpoiret commented on Nov 2, 2026

   

   clementpoiret

   on Nov 2, 2026

   Author

   More actions

   I made a PR to fix this, I'm waiting for the final review, but I think #59403 may solve this entirely
6. machineonamission commented on Nov 3, 2026

   

   machineonamission

   on Nov 3, 2026

   Last edited by machineonamission

   More actions

   i also am experiencing this

   error: hash mismatch in fixed-output derivation '/nix/store/bz20za9y1pyrdyb4ihpknp75x6lb5qzm-opencode-node_modules-2.2.5+d9184f2.drv':
            specified: sha256-UOVs48Z4yO4TJv859cg89lsul54KB9StTSl/VSQJXmc=
               got:    sha256-BQe0j5I0tQfMHeodH1O0MlWeJhMgCyoJdb9u3QeVfFg=
   

   suspiciously, the way the repo generatres these very hashes changed from opencode-agent to github-actions recently, and i have to wonder if the gh actions hasher is broken?

   

   https://github.com/anomalyco/opencode/commits/production/nix/hashes.json
7. jeremystucki

   added a commit that references this issue on Nov 5, 2026

   Temporarily disable opencode

   ...

   80ef0d3
8. odinhg

   added a commit that references this issue on Nov 5, 2026

   flake update; disable opencode and azure-cli until upstream fixes

   ...

   a62efdb
9. NoobInTheNet commented on Nov 10, 2026

   

   NoobInTheNet

   on Nov 10, 2026

   More actions

   Same on v2.2.6 (dc2ffcf) on aarch64-darwin, building the tag with the flake's own lock (no follows):

   error: hash mismatch in fixed-output derivation 'opencode-node_modules-2.2.6+dc2ffcf.drv':
            specified: sha256-AU2AUkdlL1g+hBkMZX93gQeQy6u8F0Gyzuk48yoN8as=
               got:    sha256-KKBjcy7DhWMxNR+hGWkpp90D60YIFCfjRFQuiPYymAY=
   

   The aarch64-darwin value in nix/hashes.json is the same on dev today, so the tag does not build from the flake on this platform. v2.1.2 builds.

   👍React with 👍1Reacted by Valentin Delaye
10. clementpoiret commented on Nov 10, 2026

    

    clementpoiret

    on Nov 10, 2026

    Author

    More actions

    For those in need, this is the kind of override you need in your nixos config:

            opencode = opencode.packages.${system}.default.overrideAttrs (
              old:
              pkgs-unstable.lib.optionalAttrs
                (old.version == "2.2.6+dc2ffcf" && pkgs-unstable.bun.version == "1.4.4")
                {
                  # This release's upstream hash differs with Bun 1.4.4; local and CI outputs match.
                  node_modules = old.node_modules.override {
                    hash = "sha256-O2hF8pGUSArKgYBeP99oOW3iXVVZl5bV5WPTp3E7JIA=";
                  };
                }
            );

    ❤️React with ❤️2Reacted by Valentin Delaye and Luca Tagliavini