PRs ready for review _

jbaker · August 8, 2026, 4:10pm

Would be really great if my two PRs could get some love!

github.com/NixOS/nix

libstore: cache AWS credentials across S3 requests

master ← j-baker:aws-credential-caching

opened 01:26PM - 25 Jul 26 UTC

j-baker

+31 -1

The custom credential provider chain (Environment -> SSO -> Profile -> STS WebId…entity -> ECS -> IMDS) was re-run for every S3 request, so credential sources that need a network round trip (IMDS instance profiles, ECS container credentials, STS WebIdentity, SSO) were queried once per substitution. aws-c-auth's default chain avoids this by wrapping the whole chain in a caching provider; that wrapper was lost in a4e792cba and 508d4463e. Wrap chain in aws_credentials_provider_new_cached (via the aws-crt-cpp wrapper) with the same 15-minute refresh interval the SDK default chain uses. Credentials carrying an expiration timestamp are refreshed 5 minutes before they expire; the TTL only governs credentials without one (e.g. static environment or profile credentials). Concurrent requests during a fetch now also coalesce onto a single query instead of each hitting the credential source. On auth failure the existing cache-entry eviction in getCredentials() discards the cached wrapper together with the chain, so stale credentials cannot get pinned. This commit was written with the assistance of agentic AI, and was tested with a fake S3 endpoint and counting of credential requests. Before the change, each request comes with a cred request, after there is just the one at the start.

github.com/NixOS/nix

Fix incorrect skipping of derivations with nix flake check

master ← j-baker:jbaker/remote-store-checks

opened 09:35AM - 12 Jul 26 UTC

j-baker

+108 -1

## Motivation A not-uncommon pattern in continuous integration is to have a l…ocal store for evaluation, but a remote store for builds (like `--eval-store auto --store ssh-ng://my-remote-builder.com`. This can avoid a lot of back-and-forth I/O vs remote builders because remote builders receive input and output closures over the wire, whilst remote stores only receive derivations over the wire. There's a description of this use case [here](http://docs.nixbuild.net/remote-builds/). Unfortunately, this is currently bugged, by some logic which attempts to skip flake checks that don't need to be computed. Roughly, the logic at present asks the remote whether paths exist, and then skips derivations where they are. The problem is that it assumes that the derivations are already present, and if they are not, the remote returns 'unknown'. This is then ignored. So, all flake checks will be skipped when the local eval, remote build pattern is used. I used agentic AI for this pull request and have manually reviewed its output. I am confident in the changes to flake.cc, and am less personally familiar with Nix's test suite. ## Context The change is a little bit 'hacks on hacks', as it's sitting on top of ecdda5798c0147edee01835e2be88b4415f34db8 which itself is a bit of a hack. However, it seems sensible as it's basically just more fully handling the results of that code. It's a small change, but with a full test.

Thank you in advance! One’s a bugfix, one’s a significant perf improvement on the AWS S3 codepath!