fetchGit input with ref and narHash specified, is now considered unlocked.

[liarokapisv]

We have been using builtins.fetchGit to automatically fetch sources for our company libraries (we used fetchGit instead of fetchFromGitLab due to the former taking advantage of user repo access permissions, not sure if this has since changed).
This used to look like this:

builtins.fetchGit {
   name = "company_${name}-${version}-source";
   url = "ssh://[email protected]/company/${if tool then "tools" else "libs"}/company_${name}.git";
   inherit ref;
   narHash = hash;
}

This worked fine with nix 2.18 but after updating to nix 2.24 this is no longer accepted,
nix errors with:

error: in pure evaluation mode, 'fetchGit' will not fetch unlocked input 'git+ssh://[email protected]/company/libs/xxxxxxxxx.git?exportIgnore=1&ref=refs/tags/1.0.0'

It seems that nix now considers only inputs that specify rev as locked. Is this intended? The change was made here

I would expect that specifying the narHash is enough, this is the case for other fetchers.

Missing this functionality is especially annoying because we could previously just set the hash argument to "" and nix would auto-fetch and report the proper hash, so modifying our manifest was easy. If we are forced to use rev this means that we have to go through all previous libraries and legacy versions (~50) and retrieve the proper rev.

[roberth]

Assuming the ref points to something unchanging like a tag, this "error" should be recoverable.

[liarokapisv]

Yea it is recoverable, I "just" had to generate json from the nix expressions, filter the nix-specific fields, use the tags to fetch the revs using the gitlab api, then generate a substitution script that converts the narhashes to the revs. I was lucky to have a centralised manifest file because otherwise this would be a very large undertaking.

I consider this a regression, unless there was good reason to remove this functionality.

EDIT: Reading this reply again, it may come across as a bit passive-aggressive.
Just want to clarify that I am hugely thankful to the nix team and I greately appreciate the work that you folks do.

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/2024-12-18-nix-team-meeting-minutes-204/57602/1