Changelog: Determinate Nix 3.21.7

We at Determinate Systems are pleased to announce the release of Determinate Nix version 3.21.7, based on upstream Nix 2.34.8. This release rolls up all the Determinate Nix changes since 3.21.0 and it’s headlined by performance improvements: a much faster nix copy, multi-threaded store optimization, and speedier binary caches, remote stores, and parallel evaluation. We’ve also started building Determinate Nix against Determinate Secure Packages, introduced some flake schema changes, and added a handful of smaller improvements, including the usual round of bug fixes.

Faster nix copy

Previously, nix copy processed store paths in topological order, which meant that if store path A depends on store path B, Nix wouldn’t start fetching A from the source store—or writing A to the destination store—until B had been added to the destination store.

Now, Nix can start fetching and writing store paths before their dependencies have been added to the destination store, which can provide significant speedups. This command, for example…

nix copy \
  --from file:///tmp/binary-cache \
  --to file:///tmp/binary-cache-2?compression=xz \
  --no-check-sigs \
  /nix/store/8xyk1qxxjfb8cm62g61yc59phwha92w7-kdenlive-25.08.3

…went from 117.7s to 47.2s on a machine with 24 cores.

This optimization affects copying to binary caches and local stores, but not when going through the Nix daemon. Also note that it doesn’t speed up substitution (yet).

More performance improvements

nix copy isn’t the only thing that got faster. This release includes performance work across several parts of Nix:

• Store optimization (nix store optimise) is now multi threaded.
• Binary caches benefit from a number of async rewrites from upstream Nix that make querying missing paths much faster.
• Remote stores are faster in two ways: registering temporary roots (for example, when running nix copy to a remote store over ssh-ng) is now much faster; and computing closures (for example nix-store -qR) is now much faster on high-latency ssh-ng stores.
• Parallel evaluation gets a series of improvements, with nix search in particular now faster when using parallel evaluation.

Determinate Secure Packages

Determinate Nix is now built against Determinate Secure Packages, our distribution of Nixpkgs complete with enterprise-grade security, compliance controls, and managed vulnerability remediation.

Determinate Nix’s top-level flake still builds against upstream Nixpkgs, but the version we build and cache in CI now uses our Secure Packages offering.

Flake schema changes

Flakes can now distinguish between schemas for their own outputs (via the schemas output) and schemas that they make available to other flakes (via the new exportedSchemas output). We announced this in more depth in a recent post and recommended consulting that for more detailed information.

For a practical TL;DR, if you’re using the flake-schemas flake, you should now use its exportedSchemas output:

{
  inputs.flake-schemas.url = "https://flakehub.com/f/DeterminateSystems/flake-schemas/0";

  outputs = { self, ... }@inputs: {
    schemas = inputs.flake-schemas.exportedSchemas // { /* your own schemas */ };
  };
}

Smaller improvements

• nix search now prints the total number of derivations in addition to the number of matching derivations.
• The error message shown when a user isn’t allowed to access the Nix daemon is now clearer.
• We added some missing manpages.

Bug fixes

As usual, this release includes a wide range of bug fixes and developer interface improvements. Highlights include a fix for a crash in builtins.break, a fix for SSH connection sharing, and an improved fix that prevents crashes in OpenSSL when Nix exits.

How to get Determinate Nix

If you already have Determinate Nix installed, you can upgrade to 3.21.7 with one Determinate Nixd command:

sudo determinate-nixd upgrade

If you don’t yet have Determinate Nix installed, you can upgrade or migrate to Determinate Nix on macOS using our graphical installer:

Install Determinate Nix on macOS

With support for Apple Silicon (aarch64-darwin)

On Linux:

curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | \
  sh -s -- install --determinate

On NixOS, we recommend using our dedicated NixOS module or our NixOS ISO (NixOS installer for x86_64, NixOS installer for ARM) with Determinate Nix pre-installed.

On GitHub Actions:

on:
  pull_request:
  workflow_dispatch:
  push:
    branches:
      - main

jobs:
  nix-ci:
    runs-on: ubuntu-latest
    # Include this block to log in to FlakeHub and access private flakes
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v6
      - uses: DeterminateSystems/flake-checker-action@main
      - uses: DeterminateSystems/determinate-nix-action@v3
      - uses: DeterminateSystems/flakehub-cache-action@v3
      - run: nix flake check

In Amazon Web Services:

data "aws_ami" "detsys_nixos" {
  most_recent = true
  owners      = ["535002876703"] # Commercial
  # owners      = ["579351485434"] # GovCloud
  # owners      = ["129194717446"] # European Sovereign Cloud

  filter {
    name   = "name"
    values = ["determinate/nixos/epoch-1/*"]
  }

  filter {
    name   = "architecture"
    values = ["x86_64"]
  }
}