yarn-berry_3: init at 3.8.7

[yuyuyureka]

Things done

Split off from #355053
This is required to package things which have a yarn 3 lockfile.

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[gador]

As you know, I'm all for using the different yarn packaging tools to make things easier (as I stated in my original PR), but you raised an important point in this comment:

If we don't really understand what yarn is doing under the hood to arrive at this hash, it will explode in our faces sooner or later.

So how exactly is adding yarn berry 3 to nixpkgs helping your argument? Isn't it worth waiting for your own prototype to mitigate this problem and not rush to integrate yarn berry 3?

[yuyuyureka]

The yarn-berry-fetcher which I've been working on can reliably build a cache matching the hashes in the lockfile, erroring out if anything is not reproducible exactly to the content-addressed description in the lockfile (different from using yarn, which might silently generate different result).

But that still means for a yarn 3 lockfile it'll generate a yarn 3 cache in the fixed-output-derivation, and you'll need to run yarn 3 inside the normal/non-fixed-output derivation to produce a usable node_modules from the cache.

[DimitarNestorov]

Why was this merged with 0 approvals? The update script doesn't work.

[flokli]

Why was this merged with 0 approvals? The update script doesn't work.

Consider me hitting the merge button an approval. I initially tested an earlier version of the PR, where the attribute names were still different. Fixed in #399488 (and a bump in #399489)