5.7 Pinning nixpkgs: the same build on every machine

Your mkDerivation call can be perfect and still build differently on every computer, because <nixpkgs> in angle brackets means some version of nixpkgs, not one specific version. This lesson shows how to pin nixpkgs to an exact commit so colleagues, CI, and caches all evaluate the same thing. On the way you meet fixed output derivations, the mechanism that lets a sealed off sandbox download from the internet safely.

In this video

• What <nixpkgs> and NIX_PATH actually resolve to on your machine, and why committing angle brackets to production code is a trap
• Pinning nixpkgs with fetchTarball, a GitHub commit id, and a hash
• Fixed output derivations: why this one kind of build is allowed to use the network, and what stops manipulated downloads from ever entering your store
• Pinning tools compared: niv, npins, and nixtamal, including features that flakes do not offer
• Hands-on: pinning the hello project so nix build gives everyone the identical result, with no extra tool needed at build time

After this lesson

You can pin a project to an exact nixpkgs revision and get identical builds and cache hits on every machine, and you understand the trust model that makes sandboxed downloads safe.

Builds on: Minimal mkDerivation (5.2)

Links:

• https://nixos.org/manual/nix/stable/#sec-common-env