This is because builtins.fetchTarball has a caching timeout that defaults to 1 hour.
The fetched tarball is cached for a certain amount of time (1 hour by default) in
~/.cache/nix/tarballs/. You can change the cache timeout either on the command line with--option tarball-ttl number of secondsor in the Nix configuration file with this option:tarball-ttlnumber of seconds to cache.
https://nixos.org/manual/nix/stable/#builtin-fetchTarball
You can set this with tarball-ttl. When the TTL expires, the ETag header is used to decide over freshness:
The number of seconds a downloaded tarball is considered fresh. If the cached tarball is stale, Nix will check whether it is still up to date using the ETag header. Nix will download a new version if the ETag header is unsupported, or the cached ETag doesn’t match.
https://nixos.org/manual/nix/stable/#conf-tarball-ttl
Maybe GitHub changes ETag even if the tarball stays the same?
There exists a --no-net flag since nix 2.3 that essentially disables TTL (and all downloading, actually):
Add
--no-netconvenience flag. This flag disables substituters; sets thetarball-ttlsetting to infinity (ensuring that any previously downloaded files are considered current); and disables retrying downloads and sets the connection timeout to the minimum. This flag is enabled automatically if there are no configured non-loopback network interfaces.