| name | drift |
| description | Detect configuration drift using hash-based verification. |
Configuration Drift Detection
Verify refactors produce no unintended changes by comparing derivation hashes.
Quick Commands
./scripts/hash-compare.sh
check --drift
./scripts/hash-compare.sh --summary
./scripts/hash-compare.sh framework
./scripts/hash-capture.sh
How It Works
NixOS's deterministic builds mean identical system.build.toplevel hashes guarantee identical systems. No need for complex test logic.
- MATCH: Hash unchanged - pure refactor, no functional changes
- DRIFT: Hash differs - configuration changed, nix-diff shows what
Typical Workflow
Before Refactoring
./scripts/hash-compare.sh --summary
During Refactoring
./scripts/hash-compare.sh --summary
After Refactoring
./scripts/hash-compare.sh
./scripts/hash-capture.sh
Key Features
- Processes ALL hosts - never bails on first error
- nix-diff integration shows exact root cause of changes
- Baselines auto-update in nightly CI
Files
| File | Purpose |
|---|
scripts/hash-capture.sh | Capture current hashes |
scripts/hash-compare.sh | Compare against baselines |
hashes/*.txt | Stored baseline hashes |
docs/hash-verification.md | Full documentation |