[altairprime]

Are the xattr / chattr / umask checksums rolled into the main data fork content or are they hashed separately (or not at all)?

[a_t48]

IIRC Nix is checksummed in the hash of the source of the content, not the results.

[microtonal]

Hash of a normalization of the derivation, so this roughly means source, dependencies and the ‘build recipe’. The exception are fixed-output derivations, which are typically content-hashed.

That said, a lot of work is done in content-addressed hashing, but AFAIK it’s not the default yet.