packages/npins: init at 0.1.0

Currently just a dumb copy-paste from nixpkgs

packages/projects.nix

@@ -48,6 +48,15 @@ in
 
     minio-console = pkgs.callPackage ./servers/minio-console { };
 
+    npins = let
+      inherit (inputs.self.packages.${system}) nix-super;
+    in pkgs.callPackage ./tools/npins {
+      nix = nix-super;
+      nix-prefetch-git = pkgs.nix-prefetch-git.override {
+        nix = nix-super;
+      };
+    };
+
     privatevoid-smart-card-ca-bundle = pkgs.callPackage ./data/privatevoid-smart-card-certificate-authority-bundle.nix { };
 
     reflex-cache = poetry2nix.mkPoetryApplication {

packages/tools/npins/default.nix

@@ -0,0 +1,44 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, nix-gitignore
+, makeWrapper
+, stdenv
+, darwin
+, callPackage
+
+  # runtime dependencies
+, nix # for nix-prefetch-url
+, nix-prefetch-git
+, git # for git ls-remote
+}:
+
+let
+  runtimePath = lib.makeBinPath [ nix nix-prefetch-git git ];
+  sources = (builtins.fromJSON (builtins.readFile ./sources.json)).pins;
+in rustPlatform.buildRustPackage rec {
+  pname = "npins";
+  version = src.version;
+  src = passthru.mkSource sources.npins;
+
+  cargoSha256 = "0rwnzkmx91cwcz9yw0rbbqv73ba6ggim9f4qgz5pgy6h696ld2k8";
+
+  buildInputs = lib.optional stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Security ]);
+  nativeBuildInputs = [ makeWrapper ];
+
+  # (Almost) all tests require internet
+  doCheck = false;
+
+  postFixup = ''
+    wrapProgram $out/bin/npins --prefix PATH : "${runtimePath}"
+  '';
+
+  meta = with lib; {
+    description = "Simple and convenient dependency pinning for Nix";
+    homepage = "https://github.com/andir/npins";
+    license = licenses.eupl12;
+    maintainers = with maintainers; [ piegames ];
+  };
+
+  passthru.mkSource = callPackage ./source.nix {};
+}

packages/tools/npins/source.nix

@@ -0,0 +1,57 @@
+# Not part of the public API – for use within nixpkgs only
+#
+# Usage:
+# ```nix
+# let
+#   sources = builtins.fromJSON (builtins.readFile ./sources.json);
+# in mkMyDerivation rec {
+#   version = src.version; # This obviously only works for releases
+#   src = pkgs.npins.mkSource sources.mySource;
+# }
+# ```
+
+{ fetchgit
+, fetchzip
+, fetchurl
+}:
+let
+  mkSource = spec:
+    assert spec ? type; let
+      path =
+        if spec.type == "Git" then mkGitSource spec
+        else if spec.type == "GitRelease" then mkGitSource spec
+        else if spec.type == "PyPi" then mkPyPiSource spec
+        else if spec.type == "Channel" then mkChannelSource spec
+        else throw "Unknown source type ${spec.type}";
+    in
+    spec // { outPath = path; };
+
+  mkGitSource = { repository, revision, url ? null, hash, ... }:
+    assert repository ? type;
+    # At the moment, either it is a plain git repository (which has an url), or it is a GitHub/GitLab repository
+    # In the latter case, there we will always be an url to the tarball
+    if url != null then
+      (fetchzip {
+        inherit url;
+        sha256 = hash;
+        extension = "tar";
+      })
+    else assert repository.type == "Git"; fetchgit {
+      url = repository.url;
+      rev = revision;
+    };
+
+  mkPyPiSource = { url, hash, ... }:
+    fetchurl {
+      inherit url;
+      sha256 = hash;
+    };
+
+  mkChannelSource = { url, hash, ... }:
+    fetchzip {
+      inherit url;
+      sha256 = hash;
+      extension = "tar";
+    };
+in
+  mkSource

packages/tools/npins/sources.json

@@ -0,0 +1,19 @@
+{
+  "pins": {
+    "npins": {
+      "type": "GitRelease",
+      "repository": {
+        "type": "GitHub",
+        "owner": "andir",
+        "repo": "npins"
+      },
+      "pre_releases": false,
+      "version_upper_bound": null,
+      "version": "0.1.0",
+      "revision": "5c9253ff6010f435ab73fbe1e50ae0fdca0ec07b",
+      "url": "https://api.github.com/repos/andir/npins/tarball/0.1.0",
+      "hash": "019fr9xsirld8kap75k18in3krkikqhjn4mglpy3lyhbhc5n1kh6"
+    }
+  },
+  "version": 2
+}