"Derivation": A per-package lockfile (that is, a merkle tree of dependencies with the hash of their binaries plus the hashes of any deeper dependencies... think

"Derivation": A per-package lockfile (that is, a merkle tree of dependencies with the hash of their binaries plus the hashes of any deeper dependencies... think git with its commit hashes) that is computed at runtime when that particular binary is installed or updated. This ensures that it will always run with the exact versions of the things it depends on, and upgrades to sub-dependencies (like glibc, or openssl, etc. etc.) won't suddenly break things, because multiple versions of those can now exist in parallel, since its "name" (with regards to the nix store) is not just the canonical name but the canonical name concatenated with its "commit hash" (as it were, using git language) so basically, when you install something with nix, it's specified all the way down to the bare metal (except for perhaps the kernel)