There are ways to not use IFD and not commit a “translated” lockfile.
naersk
works well for me in that regard.
As you also might have seen, actually the nix flake show
would have failed much earlier for me, as I have allow-import-from-derivation = false
in the nix.conf
, and I am really waiting for the day when that becomes the default.
Though nix flake show: don't evaluate derivations for foreign systems by default by max-privatevoid · Pull Request #6988 · NixOS/nix · GitHub could make both of us happy. I could at least consciously inspect such a flake, though would still not consume from it…