nuget-packageslock2nix

A nix flake that contains a helper function to automatically download NuGet dependencies of .NET projects based on its lock file, without having to generate a deps.nix file.

Indented for use with projects built using buildDotnetModule.

How it works

Package locks are a relatively new NuGet feature, similar to package-lock.json in npm.

To enable it, you have to set the proper MSBuild property in your .csproj files:

<PropertyGroup>
    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
</PropertyGroup>

After setting, running dotnet restore will generate a packages.lock.json file for every project. This file represents an exact list of all packages that were restored as dependencies of the given project, and should be committed to source control.

Crucially, every package in the file contains a field named contentHash, which contains a hash of the exact package that was downloaded from NuGet.

Having this hash allows us to deterministically fetch a list of packages in Nix. Without this lock file we don't have a native way to get package hashes, that's why we normally have to generate a deps.nix file using fetch-deps.

There's one catch, in that the contentHash doesn't represent the hash of the exact package that was downloaded, but of a package without it's signature (which may differ even with the same package contents). That's why, when downloading the package, we remove its signature file - this causes the contentHash to match the hash of the actual .nupkg file.

How to use it

First, make sure your project has package locks setup and committed.

Then, use the lib output of this flake, passing the following variables:

• system - the identifier of the system this is running on.
• name - optional, sets the name of the project in the generated derivation
• lockfiles - a list of all lockfiles in the project to use

Example

See the example folder for an example of usage.