Backport fetchTarball hash

[FRidh]

Could we have 06bbfb6 in 1.11.x?

[taktoa]

Seconded; we could really use this here at Awake Security.

[taktoa]

In the mean time, you can use

import <nix/fetchurl.nix> {
  url = "https://example.com/foo.nar";
  sha256 = "0hk0zxxibl7r62nmzaf4qbdrqack5xs7skcys82bqi8glf2qjr7z";
  system = builtins.currentSystem;
  executable = false;
  unpack = true;
}

(unpack = true requires the URL to be a NAR file)

Here's a good example: https://gist.github.com/taktoa/4ec8b0cb6d07857400b07a830ad99558

[FRidh]

Interesting. I knew fetchTarball shared code path and the only difference was the unpack parameter, but I didn't know you could just import it.

We could create a fetchTarball function in Nixpkgs that utilizes this until Nix 1.12 is stable. @edolstra, is there any reason against doing that?

[edolstra]

@FRidh 06bbfb6 does not cherry-pick straightforwardly on the 1.11 branch, so I'd prefer not to, sorry.

builtins.fetchTarball and <nix/fetchurl.nix> are very different in that the former doesn't rely on import-from-derivation. Import-from-derivation should generally be avoided in Nixpkgs because it causes builds at evaluation time (which fails in read-only mode, e.g. in nix-env -qa).

[FRidh]

Thank you for the clarification. I'm a happy user of 1.12 so I don't really mind.