From ecf94e84ab92c3c30b838ed18193ccd6bc5727bd Mon Sep 17 00:00:00 2001
From: Bernardo Magri <bernardo@bernardomagri.eu>
Date: Wed, 10 Jun 2026 19:05:17 +0100
Subject: [PATCH] fix(install): pin build-time deps of per-install drvs; no
 substituters offline
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Offline nixos-install still built from source: the drvs that embed the
user's hostname/username/UUIDs (etc, initrd, toplevel, HM activation)
must be REBUILT, and their builders need tools outside every runtime
closure (etc → python3-minimal, initrd → packing tools). Pin each drv's
inputDerivation into the ISO — the standard nixos-test offline trick.

Also: with no network every substituter query is a DNS retry storm that
ends in a nix goal.cc assertion crash (core dump observed); the installer
now probes connectivity and disables substituters when offline, both on
the live system and inside the nixos-enter HM pre-activation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 flake.nix                                 | 11 +++++++++++
 pkgs/nomarchy-install/nomarchy-install.sh |  9 +++++++++
 2 files changed, 20 insertions(+)

diff --git a/flake.nix b/flake.nix
index 8c3a247..3571e58 100644
--- a/flake.nix
+++ b/flake.nix
@@ -250,6 +250,17 @@
                   representativeInstall.config.system.build.toplevel
                   template.homeConfigurations.${username}.activationPackage
 
+                  # A real install rebuilds the few drvs that embed the
+                  # user's hostname/username/UUIDs (etc, initrd, toplevel,
+                  # HM activation). Their BUILDERS need tools that are in
+                  # no runtime closure (etc uses python3-minimal, the
+                  # initrd its packing tools) — inputDerivation pins each
+                  # drv's full build inputs.
+                  representativeInstall.config.system.build.toplevel.inputDerivation
+                  representativeInstall.config.system.build.etc.inputDerivation
+                  representativeInstall.config.system.build.initialRamdisk.inputDerivation
+                  template.homeConfigurations.${username}.activationPackage.inputDerivation
+
                   # …and one representative disko script: its tool closure
                   # (file, which, wrapper hooks, …) isn't otherwise on the
                   # ISO, and offline nix would try to build it from source.
diff --git a/pkgs/nomarchy-install/nomarchy-install.sh b/pkgs/nomarchy-install/nomarchy-install.sh
index 58da6f2..15a2627 100644
--- a/pkgs/nomarchy-install/nomarchy-install.sh
+++ b/pkgs/nomarchy-install/nomarchy-install.sh
@@ -68,6 +68,14 @@ grep -q nomarchy-live /etc/hostname 2>/dev/null \
 export NIX_PATH="nixpkgs=$NOMARCHY_NIXPKGS"
 export NIX_CONFIG="flake-registry = $SHARE/registry.json"
 
+# With no network, every substituter query is a DNS timeout + retry storm
+# (and tickles a nix goal.cc assertion crash). Everything an install needs
+# is pinned into the ISO — drop substituters entirely when offline.
+if ! timeout 3 bash -c '</dev/tcp/cache.nixos.org/443' 2>/dev/null; then
+    info "No network — disabling binary caches (the ISO carries everything)."
+    NIX_CONFIG+=$'\nsubstituters =\nbuilders ='
+fi
+
 # ─── Disk selection ─────────────────────────────────────────────────────
 section "Target disk"
 
@@ -413,6 +421,7 @@ section "Baking the desktop"
 cat > /mnt/tmp/nomarchy-hm-activate.sh <<EOF
 set -e
 export PATH=/run/current-system/sw/bin:\$PATH
+export NIX_CONFIG=$(printf '%q' "$NIX_CONFIG")
 out=\$(nix --extra-experimental-features "nix-command flakes" \
     build --offline --no-link --print-out-paths \
     "/home/$USERNAME/.nomarchy#homeConfigurations.$USERNAME.activationPackage")