specifically I got this exception:

couldn't execute "pgrep": no such file or directory
    while executing
"open "|pgrep -P $pid" "r""
    (procedure "get_child_pid" line 4)
    invoked from within
"get_child_pid 0"
    ("uplevel" body line 16)
    invoked from within
"uplevel 1 $code"
    (procedure "test" line 51)
    invoked from within
"test {Don't rehash if redis has child process} {
        r config set save ""
        r config set rdb-key-save-delay 1000000

        populate 4096 "..."
    ("uplevel" body line 2)
    invoked from within
"uplevel 1 $code "
    (procedure "start_server" line 3)
    invoked from within
"start_server {tags {"other external:skip"}} {
    test {Don't rehash if redis has child process} {
        r config set save ""
        r config set r..."
    (file "tests/unit/other.tcl" line 334)
    invoked from within
"source $path"
    (procedure "execute_test_file" line 4)
    invoked from within
"execute_test_file $data"
    (procedure "test_client_main" line 10)
    invoked from within

which does:

    if {[file exists "/usr/bin/pgrep"]} {
        set fd [open "|pgrep -P $pid" "r"]
        set child_pid [string trim [lindex [split [read $fd] \n] 0]]
    } else {
        set fd [open "|ps --ppid $pid -o pid" "r"]
        set child_pid [string trim [lindex [split [read $fd] \n] 1]]
    }

In reply to @yuka:yuka.dev
I have another request: In flake-enabled deployments, can we pass the nixpkgs flake so that the hive expression can use nixpkgs.lib.nixosSystem and get the proper system.nixos.(revision|versionSuffix)?

In reply to @rendakuenthusiast:imperishable.name
this is basically a failure of hermeticism, right? the redis build was happening on my system and it has one bit of source code that looks at /usr/bin/pgrep. is there a principled way in nix to make that not visible to derivations being built?

In reply to @rendakuenthusiast:imperishable.name
and when colmena tries to deploy from my laptop, I have /usr/bin/pgrep installed at that path in my normal OS

In reply to @rendakuenthusiast:imperishable.name
Winter (she/her): I'm using builtins.fetchTarball to fetch an additional module with some custom modifications I made, from a server I control

In reply to @zhaofeng:zhaofeng.li
I recommend adding a sha256 to the fetchTarball call so it's pinned to the specific version of the module and cached correctly. If you don't have a sha256, Nix itself has some time-based caching (need to look at the expiration - don't know offhand)

In reply to @rendakuenthusiast:imperishable.name
I tried doing the trick of wiping out the sha256, but it just said that the hash of the previously-downloaded version was what the hash had to be