5.8 Fetching sources: fetchurl, fetchgit, and fixed-output derivations

Real projects depend on sources you don't host: upstream tarballs, GitHub repos, internal Git servers. This lesson shows how Nix downloads them reproducibly, and answers a question every newcomer asks: why do you start with a wrong hash on purpose?

In this video

• The fake hash workflow: how practitioners add a new download in under a minute
• Why bumping a version sometimes changes nothing at all, and the caching detail behind it
• Fixed output derivations: the one case where a sandbox may use the network, and why that is still safe
• A tour of the fetchers: fetchurl, fetchzip, fetchpatch, fetchgit with submodules and authentication, fetchFromGitHub, and when companies write their own
• Trust on first use or verifying up front, plus the prefetch tools for large downloads

After this lesson

You can wire any external source into a derivation, keep it reproducible, and update it without stumbling over the stale hash trap.

Links:

• https://nixos.org/manual/nixpkgs/stable/#chap-pkgs-fetchers
• https://en.wikipedia.org/wiki/Trust_on_first_use