How to find what has changed between two builds of a derivation?

Help
1

I have two builds of subversion in my nix store. Both are prebuilt binaries downloaded from cache.nixos.org. One is working fine, while the other hangs (the svn process takes about 80% CPU time) until I stop it with Ctrl-C.

The following is working:

    $ /nix/store/war8vaw7c3k3dj5z0zbvzlqyyk2ixjin-subversion-1.14.2/bin/svn co https://svn.domain/
Authentication realm: <https://svn.domain:443> Subversion Repository
Password for 'username':

The following hangs:

    $ /nix/store/h4lib2w02pwwxmw9960b19jvnlrpqmkz-subversion-1.14.2/bin/svn co https://svn.domain/infordevel

I have installed the broken build upgrading from nixos version 22.11pre408114.5f326e2a403 to version 22.11pre408684.9608ace7009

Looking at the diffs between
https://github.com/NixOS/nixpkgs/commit/5f326e2a403e1cebaec378e72ceaf5725983376d
and
https://github.com/NixOS/nixpkgs/commit/9608ace7009ce5bc3aeb940095e01553e635cbc7

I see that now openssl = openssl_3, instead of openssl_1_1.
Then I tried installing subversion with:

    environment.systemPackages = with pkgs; [
        (subversion.override { openssl = openssl_1_1; })
    ];

in /etc/nixos/configuration.nix.

It still does not work. What else can I try?

Thanks

2

diffoscope can diff you two store entries.

3

Thank you, @Sandro! I did not know Diffoscope, is a great tool!

I have found the problem: setting openssl version for subversion is not enough; you also need to set it for its dependencies because this is not automatic. I do not know if this is a bug: is it right to link two different openssl versions from the same binary? For example, if subversion uses openssl 1.1.1, then I suppose all the libraries it uses should point to the same version. Am I right?

I have submitted the following pull request:
https://github.com/NixOS/nixpkgs/pull/192225

4

Yes, that override is not recursive.

I know this can cause issues and generally is not great but I don’t know under which exact circumstances and what to generally do. So far I assumed if it links it should work. Not sure how dlopen plays into this.