Soap Bar Hashes in Nix Derivations

Failing a build with a bogus hash just to scrape the correct checksum from the compiler error is an anti-pattern.

A common shortcut when authoring a derivation is stuffing zeroes or lib.fakeSha256 into the expression:

sha256 = "0000000000000000000000000000000000000000000000000000";
# or
sha256 = lib.fakeSha256;

You run nix build, wait for it to fail with hash mismatch, expected ... got ..., copy the string, and paste it back into the file. It works, but it treats the compiler as an interactive scratchpad and pollutes build logs.

Compute hashes upfront before touching the derivation:

1. Prefetching Tarballs & Archives

For remote source archives, compute the SRI hash directly:

# For tarballs / release archives:
nix-prefetch-url --unpack https://github.com/org/repo/archive/v1.0.0.tar.gz

# Or using modern flake CLI:
nix flake prefetch https://github.com/org/repo/archive/v1.0.0.tar.gz

For git submodules or repositories:

nix-prefetch-git https://github.com/org/repo.git --rev v1.0.0

2. Hashing Local Paths

To compute the store hash of a local directory or source tree:

nix hash path ./src

Prefetching takes seconds and keeps derivation authoring deterministic. Don’t use fake hashes to interrogate the builder.