Both come from the build, and both were non-obvious:
- fetchzip hashes the *unpacked* tree, not the .tgz bytes, so a hash computed
from the published tarball does not match; the derivation reports the NAR hash
of the extracted contents instead.
- npmDepsHash only exists once npm has materialised the dependency tree from the
committed lockfile.
Verified with nix build .#romm-mcp: the derivation builds and ./result/bin/romm-mcp
starts and prints 'RomM MCP server running on stdio'.
RomM MCP server: browse, search and administrate a self-hosted ROM library,
including triggering library scans (POST /api/tasks/scan), which RomM 5.x only
exposes through its API.
Upstream ships no package-lock.json, so the lock committed here is generated from
the published 1.0.5 tarball (npm install --package-lock-only --ignore-scripts),
pinning exactly the tree that shipped with that version. dist/ is prebuilt in the
tarball, hence dontNpmBuild.
npmDepsHash is a placeholder: it can only be derived from the lockfile by a build,
so CI (nix flake check, which builds every package) reports the real value.
hermes-agent