Changelog: faster evaluation and FedRAMP cache keys

We at Determinate Systems are pleased to announce the release of Determinate Nix version 3.21.9, based on upstream Nix 2.34.8. This release makes Nix evaluation faster by reusing results that Nix has already computed, and fixes trusted cache keys for teams working inside the FedRAMP boundary.

Faster evaluation from a warmer source cache

When Nix needs to copy a source path into the store, it first consults a fetcher cache to see if it’s already been copied. We discovered a problem in Determinate Nix where it wasn’t recording the resolved store path in the in-memory srcToStore cache, which meant that every subsequent lookup for the same path was starting over from SQLite and recomputing the fixed-output store path from scratch.

The cost of that problem adds up quickly on real evaluations. Instantiating nixpkgs#firefox, for example, required 4,744 separate fetcher cache checks for a single file, pkgs/stdenv/generic/source-stdenv.sh. Populating the cache on a hit, however, removes tens of thousands of SQLite queries and path computations from a typical evaluation. Running nix eval --json nixpkgs#firefox has now dropped from 2.02 seconds to 1.70 seconds, roughly 16% faster. This speedup won’t require any configuration changes for users.

Trusted cache keys for FedRAMP

For customers that require FedRAMP, FlakeHub runs in a separate FedRAMP authorized environment (Certification Class D under FedRAMP’s 2026 Consolidated Rules) at https://flakehub.us, and that environment has its own set of trusted binary cache public keys. Previously, Determinate Nixd was applying the keys for standard FlakeHub (the one at https://flakehub.com) regardless of which root you configured, which meant that machines pointed at flakehub.us weren’t getting the key set that they actually need.

With this release, Determinate Nixd now selects trusted public keys based on the configured FlakeHub root and uses the correct logged-in substituter endpoint when that root is flakehub.us. This fix applies everywhere the root matters: determinate-nixd status, authentication, upgrades, package installation into your profile, and more.

If you run Determinate Nix against FlakeHub’s FedRAMP environment, it’s imperative that you upgrade to 3.21.9 now. Everyone else is unaffected since the defaults for non-FedRAMP FlakeHub are unchanged.

How to get Determinate Nix

If you already have Determinate Nix installed, you can upgrade to 3.21.9 with one Determinate Nixd command:

sudo determinate-nixd upgrade

If you don’t yet have Determinate Nix installed, you can upgrade or migrate to Determinate Nix on macOS using our graphical installer:

Install Determinate Nix on macOS

With support for Apple Silicon (aarch64-darwin)

On Linux:

curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | \
  sh -s -- install --determinate

On NixOS, we recommend using our dedicated NixOS module or our NixOS ISO (NixOS installer for x86_64, NixOS installer for ARM) with Determinate Nix pre-installed.

On GitHub Actions:

on:
  pull_request:
  workflow_dispatch:
  push:
    branches:
      - main

jobs:
  nix-ci:
    runs-on: ubuntu-latest
    # Include this block to log in to FlakeHub and access private flakes
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v6
      - uses: DeterminateSystems/flake-checker-action@main
      - uses: DeterminateSystems/determinate-nix-action@v3
      - uses: DeterminateSystems/flakehub-cache-action@v3
      - run: nix flake check

In Amazon Web Services:

data "aws_ami" "detsys_nixos" {
  most_recent = true
  owners      = ["535002876703"] # Commercial
  # owners      = ["579351485434"] # GovCloud
  # owners      = ["129194717446"] # European Sovereign Cloud

  filter {
    name   = "name"
    values = ["determinate/nixos/epoch-1/*"]
  }

  filter {
    name   = "architecture"
    values = ["x86_64"]
  }
}