nix-fallback-paths.nix: Create an update script

[infinisil]

Description of changes

This is an update script for the nix-fallback-paths.nix file, which I would've liked for #233439. While effectively the same also exists in the Nix release script, that script can only be run by @edolstra and also shouldn't be in the Nix source in the first place, since it updates something for Nixpkgs.

One thing I am not sure about is how the Hydra evaluation ID to get the Nix store paths from should be determined. It should match the Hydra evaluation used for the Nix release pushed to http://releases.nixos.org/?prefix=nix, but the Hydra evaluation ID is not exposed from there.

Alternatively, we could get the Nix store paths directly from http://releases.nixos.org/?prefix=nix without going through the Hydra evaluation ID, but the binary blobs seem to be detached from their original store paths, so that's also not doable.

Ping @NixOS/nix-team

This work is sponsored by Antithesis ✨

Things done

• Run the script, testing it manually, updating the nix-fallback-paths.nix file
• Document the code and how to run it
• Add a CI check to ensure that the fallback paths are always for the same version as the current nix attribute

[thufschmitt]

Alternatively, we could get the Nix store paths directly from http://releases.nixos.org/?prefix=nix without going through the Hydra evaluation ID, but the binary blobs seem to be detached from their original store paths, so that's also not doable.

I'm wondering whether these fallback paths could just get a statically linked Nix from releases.nixos.org and import it as a CA path. That would avoid having to pull in stuff from hydra (releases.nixos.org doesn't have the static builds yet, but it wouldn't be hard to add them, and it would probably be good any way)

[edolstra]

IMHO it's a bit silly to have an update script for something that already gets output by the release script. Maybe it would help if the release script uploads the new fallback paths to the S3 bucket?

[infinisil]

@edolstra It should be the Hydra evaluation ID used for the release instead

[edolstra]

The release script now uploads fallback-paths.nix, see e.g. https://releases.nixos.org/nix/nix-2.16.1/fallback-paths.nix.

[infinisil]

@edolstra Why not the hydra evaluation ID? It doesn't make sense for the Nix release script to generate a Nixpkgs-specific file..

[edolstra]

Because it's much more convenient to do it this way.

[infinisil]

@edolstra I do not agree about that. I opened NixOS/nix#8464 with my suggested solution instead, please take a look.