In case I wasn’t sufficiently clear before, my previous reply was an alternative to the getInstantiationDeps I presented in my initial post. The idea was that to get around the function stability issues with the original proposal, we give up some granular control but retain airgappability at the installable level by just logging all the import calls (and equivalents that result in anything that isn’t a derivation, like readFile) made during a given nix build. In other words, we would no longer track imports per derivation or per Nix Value, but rather per final flake (i.e. the one not used as an input to other flakes). By appending to a global list, we no longer need to set up any complicated hermetic tracking structures. At the end of a build the store paths in the list are copied into an opaque file that allows you to nix eval a single flake/flake subattribute offline. Essentially, what I’m trying to achieve is the flake version of Deterministic evaluation of Nix expressions (and tracking who produced a derivation) · Issue #553 · NixOS/nix · GitHub.
Not just IFDs, but for airgappability we need any import or import-equivalent that depends on the existence of something outside the store to not throw. This includes, for example, your run of the mill import-from-fetchTarball.