Can't get agenix into nix shell

[johnrichardrinehart]

I have the following shell.nix and nix shell fails because of a hash mismatch of rage-unstable. Am I doing something wrong?

I'm tracking unstable and nix-shell -p rage works great and rage --version prints 0.6.0 within that shell.

shell.nix

with (import <nixpkgs> {});
let
  imports =
    let agenixCommit = "204bd95";
    in {
        agenix = (callPackage "${builtins.fetchTarball {
                url = "https://github.com/ryantm/agenix/archive/${agenixCommit}.tar.gz";
                sha256 = "0xpfq3mnpnj7ygl4yphm8mvlhbx5a87p0nh3cjgnd2v1l4m0044g";
        }}" {}).agenix;
  };
in mkShell {
  buildInput = [
        imports.agenix
  ];
}

tail of nix-shell output

   Vendoring zeroize_derive v1.0.0 (/build/source/cargo-home.MaY/registry/src/github.com-1ecc6299db9ec823/zeroize_derive-1.0.0) to rage-unstable-2020-09-05-vendor.tar.gz/zeroize_derive
   Vendoring zip v0.5.6 (/build/source/cargo-home.MaY/registry/src/github.com-1ecc6299db9ec823/zip-0.5.6) to rage-unstable-2020-09-05-vendor.tar.gz/zip
To use vendored sources, add this to your .cargo/config.toml for this project:

installing
hash mismatch in fixed-output derivation '/nix/store/wbr2864sjaqfd9zgyj4hg71b7jzfwajj-rage-unstable-2020-09-05-vendor.tar.gz':
  wanted: sha256:0r3n5x89d4r5lmz3lxn8yrs52vkbdgag1qbnnffjdcpin6kns0s3
  got:    sha256:149wg4xnzn1fk8vwhgz4aqmqm2rqbl5yhpkjqlqsha6k9nqfmhw1
cannot build derivation '/nix/store/2wa4107rhbnaxpm8lndcrbfr42ir7lfz-rage-unstable-2020-09-05.drv': 1 dependencies couldn't be built
cannot build derivation '/nix/store/iqwbqlnqvmi6hqn6v46rbbx5nippjhzi-agenix.drv': 1 dependencies couldn't be built
error: build of '/nix/store/iqwbqlnqvmi6hqn6v46rbbx5nippjhzi-agenix.drv' failed

[tomeon]

I am facing a similar issue trying to use the agenix NixOS module on NixOS 20.03:

$ sudo nixos-rebuild build --flake '.#'                                                                                                                                                                                                                                                                           
building the system configuration...                                                                                                                                                                                                 
error: --- Error ------------------------------------------------------------------------------------------------------------------- nix
hash mismatch in fixed-output derivation '/nix/store/ddq20bf6hy4g8aqackpvi8wamhw5vvcy-rage-0.5.0-vendor':                               
  wanted: sha256-GPr5zxeODAjD+ynp/nned9gZUiReYcdzosuEbLIKZSs=                                                                           
  got:    sha256-OstJkBNUlpy6toDThhkQQxaFuwfVfemfBBLKvNMOaog=                                                                           
error: --- Error ------------------------------------------------------------------------------------------------------------------- nix
1 dependencies of derivation '/nix/store/hq3zbdffnv94dxqax44hv9jbc89xs0lv-rage-0.5.0.drv' failed to build                               
error: --- Error ------------------------------------------------------------------------------------------------------------------- nix
1 dependencies of derivation '/nix/store/shizgjrfmsyyj6lm73yiiafidpphi597-nixos-system-myhost-20.03.20200920.773ef5a.drv' failed to
 build                                                                                                                                  

Apparently there was recently an issue with cargo that impacted the calculation of cargoSha256; wonder if we're somehow being affected by that?

[ryantm]

@johnrichardrinehart Interesting that it is building rage-unstable-2020-09-05.drv. I don't see that in the history of nixpkgs at all. Any idea where that is coming from?

@tomeon Sorry, I'm going to say we aren't going to try to support NixOS 20.03 for a variety of reasons.

[johnrichardrinehart]

@ryantm Thanks for your attention to this and for your work in creating agenix. This response will be fairly long so, first:

TL;DR: Unable to reproduce, so closing.

Updates

Review

Unfortunately, I wasn't being too disciplined in keeping a working directory with a few scripts that could faithfully reproduce this issue. And, my original past didn't include all of the source. I've also been learning nix a lot over the past week, so looking at my original post, again, I noticed a couple of weird things.

1. I have an unnecessarily complicated value for the imports.agenix attribute in ll. 6-9 of the shell.nix. It seems that the below is cleaner

-      agenix = (callPackage "${builtins.fetchTarball {
-               url = "https://github.com/ryantm/agenix/archive/${agenixCommit}.tar.gz";
-               sha256 = "0xpfq3mnpnj7ygl4yphm8mvlhbx5a87p0nh3cjgnd2v1l4m0044g";
-       }}" {}).agenix
+      agenix = import
+          (builtins.fetchTarball {
+             url = "https://github.com/ryantm/agenix/archive/${agenixCommit}.tar.gz";
+             sha256 = "0sva64h0a14nim1f3mz0m2d84mnpk1fx2cf0zvnbphn7rgv4vgbk";
+          })
+          { inherit pkgs; };

2. Also, I never set any buildInputs. I have buildInput, which is unused. So, even if it evaluated successfully, agenix wouldn't exist in my shell/path.

So, I've cleaned up my shell.nix (and flake.nix for nix develop) and I've included the working versions at the bottom, here, along with my flake.lock in case anyone wants to reproduce this working version.

Origins of unstable-2020-09-05

Since I was unable to reproduce the original build error for this issue, I tried to grep through /nix/store to see if anything interesting would turn up in a derivation.

[nix-shell:~]$ sudo rg -n -U -e "unstable-2020-09-05" /nix/store/*
/nix/store/m3mn3083sc5wbb1qa8x7dgvd6larflgm-rage-unstable-2020-09-05-vendor.tar.gz.drv
1:Derive([("out","/nix/store/w49bprcyf3rwk2vwkflvj6a0n4dvyxij-rage-unstable-2020-09-05-vendor.tar.gz","sha256","43036da7b1f1b2269db376e1f0d46b6b6e5174f6c8763a7ea5259396502f7664")],[("/nix/store/1p83yfzirz5bg4917i6z20qnpgziq6fb-source.drv",["out"]),("/nix/store/701sb3vbknxcm2a9c5pma458cl21an9l-git-2.31.1.drv",["out"]),("/nix/store/7ym75i4wq5ldpknbacafcl27hrdb01yi-nss-cacert-3.63.drv",["out"]),("/nix/store/f5zjnz7h4gchgvvkrsv9b3nirzspi8q9-stdenv-linux.drv",["out"]),("/nix/store/my57g2nphlngmrmlnkabnw3v8sdf5pwy-cargo-vendor-normalise.drv",["out"]),("/nix/store/qkiacn153fga36da287yx95snjkyxjj8-cargo-1.51.0.drv",["out"]),("/nix/store/yj69pii00fzamzhgs63c8cwgml50wl3z-bash-4.4-p23.drv",["out"])],["/nix/store/9krlzvny65gdc8s7kpb6lkx8cd02c25b-default-builder.sh"],"x86_64-linux","/nix/store/68c5b0h2w2ab57sbas1b4m073ik8hlm5-bash-4.4-p23/bin/bash",["-e","/nix/store/9krlzvny65gdc8s7kpb6lkx8cd02c25b-default-builder.sh"],[("buildInputs",""),("buildPhase","# Ensure deterministic Cargo vendor builds\nexport SOURCE_DATE_EPOCH=1\n\nif [[ ! -f Cargo.lock ]]; then\n    echo\n    echo \"ERROR: The Cargo.lock file doesn't exist\"\n    echo\n    echo \"Cargo.lock is needed to make sure that cargoHash/cargoSha256 doesn't change\"\n    echo \"when the registry is updated.\"\n    echo\n\n    exit 1\nfi\n\n# Keep the original around for copyLockfile\ncp Cargo.lock Cargo.lock.orig\n\nexport CARGO_HOME=$(mktemp -d cargo-home.XXX)\nCARGO_CONFIG=$(mktemp cargo-config.XXXX)\n\n\n\ncargo vendor $name | cargo-vendor-normalise > $CARGO_CONFIG\n\n# Add the Cargo.lock to allow hash invalidation\ncp Cargo.lock.orig $name/Cargo.lock\n\n# Packages with git dependencies generate non-default cargo configs, so\n# always install it rather than trying to write a standard default template.\ninstall -D $CARGO_CONFIG $name/.cargo/config;\n"),("builder","/nix/store/68c5b0h2w2ab57sbas1b4m073ik8hlm5-bash-4.4-p23/bin/bash"),("configureFlags",""),("depsBuildBuild",""),("depsBuildBuildPropagated",""),("depsBuildTarget",""),("depsBuildTargetPropagated",""),("depsHostHost",""),("depsHostHostPropagated",""),("depsTargetTarget",""),("depsTargetTargetPropagated",""),("doCheck",""),("doInstallCheck",""),("hash",""),("impureEnvVars","http_proxy https_proxy ftp_proxy all_proxy no_proxy"),("installPhase","tar --owner=0 --group=0 --numeric-owner --format=gnu \\\n    --sort=name --mtime=\"@$SOURCE_DATE_EPOCH\" \\\n    -czf $out $name\n"),("name","rage-unstable-2020-09-05-vendor.tar.gz"),("nativeBuildInputs","/nix/store/732wsyyfia0l69nj5n1046gg35azjqnq-nss-cacert-3.63
/nix/store/p0znfyid8jf9qyrv23hl3rgnc91zk1m5-git-2.31.1 /nix/store/rn65mhj5x0lzqk5vps9zlnzxym7z0k24-cargo-vendor-normalise /nix/store/nsa5grh69xbq5h17xmkq9120d94xnk8d-cargo-1.51.0"),("out","/nix/store/w49bprcyf3rwk2vwkflvj6a0n4dvyxij-rage-unstable-2020-09-05-vendor.tar.gz"),("outputHash","sha256-QwNtp7Hxsiads3bh8NRra25RdPbIdjp+pSWTllAvdmQ="),("outputHashAlgo","sha256"),("outputs","out"),("patches",""),("phases","unpackPhase patchPhase buildPhase installPhase"),("propagatedBuildInputs",""),("propagatedNativeBuildInputs",""),("src","/nix/store/x512mkdn8vl3w52b5r0y5wqm8g2c62bm-source"),("stdenv","/nix/store/6xss8bksa5hsjl981y9as0adrcyjfgkl-stdenv-linux"),("strictDeps",""),("system","x86_64-linux")])

/nix/store/iqwbqlnqvmi6hqn6v46rbbx5nippjhzi-agenix.drv
1:Derive([("out","/nix/store/gaawjrx0rw3ma3s0372cn60yvmnmahd9-agenix","","")],[("/nix/store/2wa4107rhbnaxpm8lndcrbfr42ir7lfz-rage-unstable-2020-09-05.drv",["out"]),("/nix/store/kqw3y8f4h6kbyw0zp97sp9i1mn9ycg8x-stdenv-linux.drv",["out"]),("/nix/store/yj69pii00fzamzhgs63c8cwgml50wl3z-bash-4.4-p23.drv",["out"])],["/nix/store/9krlzvny65gdc8s7kpb6lkx8cd02c25b-default-builder.sh"],"x86_64-linux","/nix/store/68c5b0h2w2ab57sbas1b4m073ik8hlm5-bash-4.4-p23/bin/bash",["-e","/nix/store/9krlzvny65gdc8s7kpb6lkx8cd02c25b-default-builder.sh"],[("allowSubstitutes",""),("buildCommand","n=$out/bin/agenix\nmkdir -p \"$(dirname \"$n\")\"\n\nif [ -e \"$textPath\" ]; then\n  mv \"$textPath\" \"$n\"\nelse\n  echo -n \"$text\" > \"$n\"\nfi\n\n/nix/store/68c5b0h2w2ab57sbas1b4m073ik8hlm5-bash-4.4-p23/bin/bash -n $out/bin/agenix\n\n\n(test -n \"$executable\" && chmod +x \"$n\") || true\n"),("buildInputs",""),("builder","/nix/store/68c5b0h2w2ab57sbas1b4m073ik8hlm5-bash-4.4-p23/bin/bash"),("configureFlags",""),("depsBuildBuild",""),("depsBuildBuildPropagated",""),("depsBuildTarget",""),("depsBuildTargetPropagated",""),("depsHostHost",""),("depsHostHostPropagated",""),("depsTargetTarget",""),("depsTargetTargetPropagated",""),("doCheck",""),("doInstallCheck",""),("executable","1"),("name","agenix"),("nativeBuildInputs",""),("out","/nix/store/gaawjrx0rw3ma3s0372cn60yvmnmahd9-agenix"),("outputs","out"),("passAsFile","buildCommand text"),("patches",""),("preferLocalBuild","1"),("propagatedBuildInputs",""),("propagatedNativeBuildInputs",""),("stdenv","/nix/store/p799a5y9pkw2rqs1s83f5aah7ds4pkr9-stdenv-linux"),("strictDeps",""),("system","x86_64-linux"),("text","#!/nix/store/68c5b0h2w2ab57sbas1b4m073ik8hlm5-bash-4.4-p23/bin/bash\nset -Eeuo pipefail\n\nPACKAGE=\"agenix\"\n\nfunction show_help () {\n  echo \"$PACKAGE - edit and rekey age secret files\"\n  echo \" \"\n  echo \"$PACKAGE -e FILE [-i PRIVATE_KEY]\"\n  echo \"$PACKAGE -r [-i PRIVATE_KEY]\"\n  echo ' '\n  echo 'options:'\n  echo '-h, --help                show help'\n  echo '-e, --edit FILE           edits FILE using $EDITOR'\n  echo '-r, --rekey               re-encrypts all secrets with specified recipients'\n  echo '-i,
--identity            identity to use when decrypting'\n  echo ' '\n  echo 'FILE an age-encrypted file'\n  echo ' '\n  echo 'PRIVATE_KEY a path to a private SSH key used to decrypt file'\n  echo ' '\n  echo 'EDITOR environment variable of editor to use when editing FILE'\n  echo ' '\n  echo 'RULES environment variable with path to Nix file specifying recipient public keys.'\n  echo \"Defaults to './secrets.nix'\"\n  echo ' '\n  echo \"age binary path: /nix/store/h5f0d8isjp9wq03kb0xxfr9sc7dms2xb-rage-unstable-2020-09-05/bin/rage\"\n  echo \"age version: $(/nix/store/h5f0d8isjp9wq03kb0xxfr9sc7dms2xb-rage-unstable-2020-09-05/bin/rage --version)\"\n}\n\ntest $# -eq 0 && (show_help && exit 1)\n\nREKEY=0\nDEFAULT_DECRYPT=(--decrypt)\n\nwhile test $# -gt 0; do\n  case \"$1\" in\n    -h|--help)\n      show_help\n      exit 0\n      ;;\n    -e|--edit)\n      shift\n      if test $# -gt 0; then\n        export FILE=$1\n      else\n        echo \"no FILE specified\"\n        exit 1\n      fi\n      shift\n      ;;\n    -i|--identity)\n      shift\n      if test $# -gt 0; then\n        DEFAULT_DECRYPT+=(--identity \"$1\")\n      else\n        echo \"no PRIVATE_KEY specified\"\n        exit 1\n      fi\n      shift\n      ;;\n    -r|--rekey)\n      shift\n      REKEY=1\n      ;;\n    *)\n      show_help\n      exit 1\n      ;;\n  esac\ndone\n\nRULES=${RULES:-./secrets.nix}\n\nfunction cleanup {\n    if [ ! -z ${CLEARTEXT_DIR+x} ]\n    then\n
    rm -rf \"$CLEARTEXT_DIR\"\n    fi\n    if [ ! -z ${REENCRYPTED_DIR+x} ]\n    then\n        rm -rf \"$REENCRYPTED_DIR\"\n    fi\n}\ntrap \"cleanup\" 0 2 3 15\n\nfunction edit {\n    FILE=$1\n    KEYS=$((nix-instantiate --eval -E \"(let rules = import $RULES; in builtins.concatStringsSep \\\"\\n\\\" rules.\\\"$FILE\\\".publicKeys)\" | sed 's/\"//g' | sed 's/\\\\n/\\n/g') || exit 1)\n\n    if [ -z \"$KEYS\" ]\n    then\n        >&2 echo \"There is no rule for $FILE in $RULES.\"\n        exit 1\n    fi\n\n    CLEARTEXT_DIR=$(mktemp -d)\n    CLEARTEXT_FILE=\"$CLEARTEXT_DIR/$(basename \"$FILE\")\"\n\n    if [ -f \"$FILE\" ]\n    then\n        DECRYPT=(\"${DEFAULT_DECRYPT[@]}\")\n        while IFS= read -r key\n        do\n            DECRYPT+=(--identity \"$key\")\n        done <<<\"$((find ~/.ssh -maxdepth 1 -type f -not -name \"*pub\" -not -name \"config\" -not -name \"authorized_keys\" -not -name \"known_hosts\") || exit 1)\"\n        DECRYPT+=(-o \"$CLEARTEXT_FILE\" \"$FILE\")\n        /nix/store/h5f0d8isjp9wq03kb0xxfr9sc7dms2xb-rage-unstable-2020-09-05/bin/rage \"${DECRYPT[@]}\" || exit 1\n        cp \"$CLEARTEXT_FILE\" \"$CLEARTEXT_FILE.before\"\n    fi\n\n    $EDITOR \"$CLEARTEXT_FILE\"\n\n    if [ ! -f \"$CLEARTEXT_FILE\" ]\n    then\n      echo \"$FILE wasn't created.\"\n      return\n    fi\n    [ -f \"$FILE\" ] && [ \"$EDITOR\" != \":\" ] && diff \"$CLEARTEXT_FILE.before\" \"$CLEARTEXT_FILE\" 1>/dev/null && echo \"$FILE wasn't changed, skipping re-encryption.\" && return\n\n    ENCRYPT=()\n    while IFS= read -r key\n    do\n        ENCRYPT+=(--recipient \"$key\")\n    done <<< \"$KEYS\"\n\n    REENCRYPTED_DIR=$(mktemp -d)\n    REENCRYPTED_FILE=\"$REENCRYPTED_DIR/$(basename \"$FILE\")\"\n\n    ENCRYPT+=(-o \"$REENCRYPTED_FILE\")\n\n    /nix/store/h5f0d8isjp9wq03kb0xxfr9sc7dms2xb-rage-unstable-2020-09-05/bin/rage \"${ENCRYPT[@]}\" <\"$CLEARTEXT_FILE\" || exit 1\n\n    mv -f \"$REENCRYPTED_FILE\" \"$1\"\n}\n\nfunction rekey {\n    FILES=$((nix-instantiate --eval -E \"(let rules = import $RULES; in builtins.concatStringsSep \\\"\\n\\\" (builtins.attrNames rules))\"  | sed 's/\"//g' | sed 's/\\\\n/\\n/g') || exit 1)\n\n    for FILE in $FILES\n    do\n        echo \"rekeying $FILE...\"\n        EDITOR=: edit \"$FILE\"\n        cleanup\n    done\n}\n\n[ $REKEY -eq 1 ] && rekey && exit 0\nedit \"$FILE\" && cleanup && exit 0\n\n")])
/nix/store/il563bkh4b6fw2mc3qhbx4ihdszpfirx-linux-5.10.32/lib/modules/5.10.32/kernel/sound/soc/amd/acp_audio_dma.ko.xz: Bad message (os error 74)
/nix/store/il563bkh4b6fw2mc3qhbx4ihdszpfirx-linux-5.10.32/lib/modules/5.10.32/kernel/sound/soc/amd/raven/snd-acp3x-i2s.ko.xz: Bad message (os error 74)
/nix/store/il563bkh4b6fw2mc3qhbx4ihdszpfirx-linux-5.10.32/lib/modules/5.10.32/kernel/sound/pci/snd-via82xx.ko.xz: Bad message (os error 74)
/nix/store/il563bkh4b6fw2mc3qhbx4ihdszpfirx-linux-5.10.32/lib/modules/5.10.32/kernel/sound/pci/vx222/snd-vx222.ko.xz: Bad message (os error 74)
/nix/store/il563bkh4b6fw2mc3qhbx4ihdszpfirx-linux-5.10.32/lib/modules/5.10.32/kernel/sound/pci/ymfpci/snd-ymfpci.ko.xz: Bad message (os error 74)
/nix/store/il563bkh4b6fw2mc3qhbx4ihdszpfirx-linux-5.10.32/lib/modules/5.10.32/kernel/sound/pci/trident/snd-trident.ko.xz: Bad message (os error 74)
/nix/store/il563bkh4b6fw2mc3qhbx4ihdszpfirx-linux-5.10.32/lib/modules/5.10.32/kernel/sound/pcmcia/vx/snd-vxpocket.ko.xz: Bad message (os error 74)
/nix/store/il563bkh4b6fw2mc3qhbx4ihdszpfirx-linux-5.10.32/lib/modules/5.10.32/kernel/sound/pcmcia/pdaudiocf/snd-pdaudiocf.ko.xz: Bad message (os error 74)

/nix/store/hwk052wn7a0m0bcy1m8klhk73m339a70-source/pkgs/rage.nix
5:  version = "unstable-2020-09-05";

/nix/store/2wa4107rhbnaxpm8lndcrbfr42ir7lfz-rage-unstable-2020-09-05.drv
1:Derive([("out","/nix/store/h5f0d8isjp9wq03kb0xxfr9sc7dms2xb-rage-unstable-2020-09-05","","")],[("/nix/store/1p83yfzirz5bg4917i6z20qnpgziq6fb-source.drv",["out"]),("/nix/store/42hs8hhya8q8sqr6i3xx0nydwdbyzkik-rustc-1.51.0.drv",["out"]),("/nix/store/701sb3vbknxcm2a9c5pma458cl21an9l-git-2.31.1.drv",["out"]),("/nix/store/7ym75i4wq5ldpknbacafcl27hrdb01yi-nss-cacert-3.63.drv",["out"]),("/nix/store/9arpgfk7hq0h0ccbflc2cgkza2lxkv1x-cargo-install-hook.sh.drv",["out"]),("/nix/store/c0k603hxdpyjfmdzy9al31jfvzw836s4-cargo-check-hook.sh.drv",["out"]),("/nix/store/f5zjnz7h4gchgvvkrsv9b3nirzspi8q9-stdenv-linux.drv",["out"]),("/nix/store/fa5vzifzakc52r6zhjg962zkpjdw4yzk-cargo-build-hook.sh.drv",["out"]),("/nix/store/gw23gvs75f9lidy4gl22i4swn1wqwnlg-install-shell-files.drv",["out"]),("/nix/store/k2lizxlnk3srwq9njna2n83qjz6jbrj3-cargo-setup-hook.sh.drv",["out"]),("/nix/store/m3mn3083sc5wbb1qa8x7dgvd6larflgm-rage-unstable-2020-09-05-vendor.tar.gz.drv",["out"]),("/nix/store/yj69pii00fzamzhgs63c8cwgml50wl3z-bash-4.4-p23.drv",["out"])],["/nix/store/9krlzvny65gdc8s7kpb6lkx8cd02c25b-default-builder.sh","/nix/store/nk6b2ckznjic5wj8ddw0wgdrn4mbz3lg-patch-registry-deps"],"x86_64-linux","/nix/store/68c5b0h2w2ab57sbas1b4m073ik8hlm5-bash-4.4-p23/bin/bash",["-e","/nix/store/9krlzvny65gdc8s7kpb6lkx8cd02c25b-default-builder.sh"],[("PKG_CONFIG_ALLOW_CROSS","0"),("buildInputs",""),("builder","/nix/store/68c5b0h2w2ab57sbas1b4m073ik8hlm5-bash-4.4-p23/bin/bash"),("cargoBuildType","release"),("cargoCheckType","release"),("cargoDeps","/nix/store/w49bprcyf3rwk2vwkflvj6a0n4dvyxij-rage-unstable-2020-09-05-vendor.tar.gz"),("cargoSha256","sha256-QwNtp7Hxsiads3bh8NRra25RdPbIdjp+pSWTllAvdmQ="),("configureFlags",""),("configurePhase","runHook preConfigure\nrunHook postConfigure\n"),("depsBuildBuild",""),("depsBuildBuildPropagated",""),("depsBuildTarget",""),("depsBuildTargetPropagated",""),("depsHostHost",""),("depsHostHostPropagated",""),("depsTargetTarget",""),("depsTargetTargetPropagated",""),("doCheck","1"),("doInstallCheck",""),("name","rage-unstable-2020-09-05"),("nativeBuildInputs","/nix/store/aks2kxgxiglfww3msgnxyy15slkxn48y-install-shell-files /nix/store/732wsyyfia0l69nj5n1046gg35azjqnq-nss-cacert-3.63 /nix/store/p0znfyid8jf9qyrv23hl3rgnc91zk1m5-git-2.31.1 /nix/store/1z1w2plclbwcygabd97smzzmdgn4p1kz-cargo-build-hook.sh /nix/store/gjm75idgmi3cqknajrfhgm0vxz0kzzmj-cargo-check-hook.sh /nix/store/3pj39bqwyv3ajsrjpdh8g5v6bdyr3yn3-cargo-install-hook.sh /nix/store/8gp2lr0iwa2crdm0hgx7sc8bllzjdvfd-cargo-setup-hook.sh /nix/store/r562x1yp3c0lkaa3fv2k5nv6mwcqfvfi-rustc-1.51.0"),("out","/nix/store/h5f0d8isjp9wq03kb0xxfr9sc7dms2xb-rage-unstable-2020-09-05"),("outputs","out"),("patchRegistryDeps","/nix/store/nk6b2ckznjic5wj8ddw0wgdrn4mbz3lg-patch-registry-deps"),("patches",""),("pname","rage"),("postBuild","cargo run --example generate-docs\ncargo run --example generate-completions\n"),("postInstall","installManPage target/manpages/*\ninstallShellCompletion target/completions/*.{bash,fish,zsh}\n"),("postUnpack","eval \"$cargoDepsHook\"\n\nexport RUST_LOG=\n"),("propagatedBuildInputs",""),("propagatedNativeBuildInputs",""),("src","/nix/store/x512mkdn8vl3w52b5r0y5wqm8g2c62bm-source"),("stdenv","/nix/store/6xss8bksa5hsjl981y9as0adrcyjfgkl-stdenv-linux"),("strictDeps","1"),("system","x86_64-linux"),("version","unstable-2020-09-05")])

So, outside of a few errors related to searching linux kernel modules (irrelevant, I think) there are only a few files that contain this string.

/nix/store/m3mn3083sc5wbb1qa8x7dgvd6larflgm-rage-unstable-2020-09-05-vendor.tar.gz.drv
/nix/store/iqwbqlnqvmi6hqn6v46rbbx5nippjhzi-agenix.drv
/nix/store/hwk052wn7a0m0bcy1m8klhk73m339a70-source/pkgs/rage.nix
/nix/store/2wa4107rhbnaxpm8lndcrbfr42ir7lfz-rage-unstable-2020-09-05.drv

The relevant one is seemingly /nix/store/hwk.../pkgs/rage.nix that includes this string in its version attribute.

The <nixpkgs> that the nix shell command is trying to evaluate comes from my $NIX_PATH which is

[nix-shell:/nix/var/nix/profiles/per-user/root]$ echo $NIX_PATH
/home/john/.nix-defexpr/channels:nixpkgs=/nix/var/nix/profiles/per-user/root/channels/nixos:nixos-config=/etc/nixos/configuration.nix:/nix/var/nix/profiles/per-user/root/channels

Taking a look at the value of nixpkgs (/nix/var/nix/profiles/per-user/root-channels/nixos tells me what commit I've checked out from github.com/NixOS/nixpkgs which looks like

[nix-shell:/nix/var/nix/profiles/per-user/root]$ cat /nix/var/nix/profiles/per-user/root/channels/nixos/.git-revision
39e6bf76474ce742eb027a88c4da6331f0a1526f

Cloning and checking out this commit....

[john@nixos:~/nixpkgs]$ rg unstable-2020-09 .
./pkgs/misc/tmux-plugins/default.nix
384:    version = "unstable-2020-09-18";

./pkgs/tools/misc/cod/default.nix
5:  version = "unstable-2020-09-10";

./pkgs/tools/graphics/amber/default.nix
48:  version = "unstable-2020-09-23";

./pkgs/tools/backup/zfsbackup/default.nix
5:  version = "unstable-2020-09-30";

./pkgs/desktops/pantheon/desktop/wingpanel-indicators/session/default.nix
19:  version = "unstable-2020-09-13";

./pkgs/applications/networking/instant-messengers/jackline/default.nix
7:  version = "unstable-2020-09-03";

./pkgs/development/compilers/gambit/unstable.nix
4:  version = "unstable-2020-09-20";

./pkgs/development/libraries/libzra/default.nix
8:  version = "unstable-2020-09-11";

./pkgs/development/python-modules/skidl/default.nix
16:  version = "unstable-2020-09-15";

So, there are a number of packages that include a version of the form unstable-<YYYY>-<MM>-<DD>, but rage isn't one of them. So, in summary, I still have no idea where that version string came from.

Files

[john@nixos:~]$ cat agenix/shell.nix

{ pkgs ? (import <nixpkgs> { }) }:
with pkgs;
let
  imports =
    let agenixCommit = "204bd95";
    in
    {
      agenix = import
        (builtins.fetchTarball {
          url = "https://github.com/ryantm/agenix/archive/${agenixCommit}.tar.gz";
          sha256 = "0sva64h0a14nim1f3mz0m2d84mnpk1fx2cf0zvnbphn7rgv4vgbk";
        })
        { inherit pkgs; };
    };
in
mkShell { buildInputs = [ imports.agenix.agenix ]; }

[john@nixos:~]$ cat agenix/flake.nix

{
  description = "my project description";

  inputs.nixpkgs.url = "github:nixos/nixpkgs/release-20.09";
  inputs.flake-utils.url = "github:numtide/flake-utils";

  outputs = { self, nixpkgs, flake-utils }:
    flake-utils.lib.eachDefaultSystem
      (system:
        let pkgs = nixpkgs.legacyPackages.${system}; in
        {
          devShell = import ./shell.nix { inherit pkgs; };
        }
      );
}

[john@nixos:~]$ cat agenix/flake.lock

{
  "nodes": {
    "flake-utils": {
      "locked": {
        "lastModified": 1620759905,
        "narHash": "sha256-WiyWawrgmyN0EdmiHyG2V+fqReiVi8bM9cRdMaKQOFg=",
        "owner": "numtide",
        "repo": "flake-utils",
        "rev": "b543720b25df6ffdfcf9227afafc5b8c1fabfae8",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
        "repo": "flake-utils",
        "type": "github"
      }
    },
    "nixpkgs": {
      "locked": {
        "lastModified": 1620878828,
        "narHash": "sha256-pQ8wSfdY0SZ903bjfi3oCp+9sHSf1uf1v+hg9XrBOxE=",
        "owner": "nixos",
        "repo": "nixpkgs",
        "rev": "c85e2a478c26cfd77d1445169e51475afe9cc7cd",
        "type": "github"
      },
      "original": {
        "owner": "nixos",
        "ref": "release-20.09",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "root": {
      "inputs": {
        "flake-utils": "flake-utils",
        "nixpkgs": "nixpkgs"
      }
    }
  },
  "root": "root",
  "version": 7
}