forked from
lass.pds.lassul.us/superconfig
This repository has no description
pi wrapperModule: use fetchurl for reproducible plugin builds
Replace FOD npm install with fetchurl tarballs + manual assembly.
npm install is non-deterministic across systems, causing hash mismatches.
fetchurl downloads exact versioned tarballs from npm registry (always
identical), then we unpack them into the node_modules structure directly.
- Add version and deps options to package schema
- Fetch tarballs with fetchurl (deterministic per version)
- Assemble node_modules tree without npm
- Strip version/deps from settings.json (only needed for nix fetching)
author
opencrow
date
(Feb 22, 2026, 12:33 AM CET)
commit
c7446e3e
c7446e3ef1729d363701cc270d04aa0b865c1e6d
parent
78a20737
78a207379c494431e17f8bc4817b0529ede67bcf
+34
-15
+3
-1
tools/pi/flake-module.nix
+3
-1
tools/pi/flake-module.nix
···
11
11
packages = [
12
12
{
13
13
source = "npm:pi-hooks";
14
+
version = "1.0.3";
14
15
hash = "sha256-IYXckWXmRsX62aQANatkcu2kV+PXT5mNB2ONpJsOPMI=";
15
16
}
16
17
{
17
18
source = "npm:shitty-extensions";
18
-
hash = "sha256-OJZezuRDUiKysfkjJxeA6BjGohFR/+uVg611jGaRTV0=";
19
+
version = "1.0.9";
20
+
hash = "sha256-Qv1mDM3LVauxwPNojCN5kj6yAtKOXodwbtqQk02RqPQ=";
19
21
extensions = [ "!extensions/resistance.ts" ];
20
22
}
21
23
];
+31
-14
wrapperModules/pi/flake-module.nix
+31
-14
wrapperModules/pi/flake-module.nix
···
11
11
12
12
# Extract npm packages with hashes from settings.packages
13
13
npmPackages = lib.filter (p: builtins.isAttrs p && p ? hash) (config.settings.packages or [ ]);
14
+
15
+
# Fetch an npm tarball and unpack it into lib/node_modules/<name>
14
16
fetchPlugin =
15
17
pkg:
16
18
let
17
19
source = pkg.source or pkg;
18
20
name = lib.removePrefix "npm:" source;
21
+
tarball = pkgs.fetchurl {
22
+
url = "https://registry.npmjs.org/${name}/-/${name}-${pkg.version}.tgz";
23
+
hash = pkg.hash;
24
+
};
25
+
deps = map fetchPlugin (pkg.deps or [ ]);
19
26
in
20
27
pkgs.runCommand "pi-plugin-${name}"
21
28
{
22
29
nativeBuildInputs = [
23
-
pkgs.nodejs
24
-
pkgs.cacert
30
+
pkgs.gnutar
31
+
pkgs.gzip
25
32
];
26
-
outputHashMode = "recursive";
27
-
outputHashAlgo = "sha256";
28
-
outputHash = pkg.hash;
29
-
impureEnvVars = [
30
-
"http_proxy"
31
-
"https_proxy"
32
-
];
33
-
SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
34
33
}
35
34
''
36
-
export HOME=$TMPDIR
37
-
export npm_config_prefix=$out
38
-
npm install -g ${name}
35
+
mkdir -p $out/lib/node_modules/${name}
36
+
tar xzf ${tarball} --strip-components=1 -C $out/lib/node_modules/${name}
37
+
${lib.concatMapStringsSep "\n" (
38
+
dep:
39
+
"mkdir -p $out/lib/node_modules/${name}/node_modules"
40
+
+ "\ncp -a ${dep}/lib/node_modules/* $out/lib/node_modules/${name}/node_modules/"
41
+
+ "\ncp -a ${dep}/lib/node_modules/* $out/lib/node_modules/"
42
+
) deps}
39
43
'';
40
44
41
45
fetchedPlugins = map fetchPlugin npmPackages;
42
46
43
47
# Strip hash and null-valued attrs from package entries before writing settings.json
44
48
cleanPackage =
45
-
p: if builtins.isAttrs p then lib.filterAttrs (k: v: k != "hash" && v != null) p else p;
49
+
p:
50
+
if builtins.isAttrs p then
51
+
lib.filterAttrs (k: v: k != "hash" && k != "version" && k != "deps" && v != null) p
52
+
else
53
+
p;
46
54
47
55
cleanSettings = config.settings // {
48
56
packages = map cleanPackage (config.settings.packages or [ ]);
···
69
77
options.source = lib.mkOption {
70
78
type = lib.types.str;
71
79
description = "Package source (e.g. npm:package-name).";
80
+
};
81
+
options.version = lib.mkOption {
82
+
type = lib.types.str;
83
+
description = "Exact version to pin (e.g. 1.0.3). Ensures reproducible fetching.";
84
+
};
85
+
options.deps = lib.mkOption {
86
+
type = lib.types.listOf (lib.types.attrsOf lib.types.anything);
87
+
default = [ ];
88
+
description = "Transitive npm dependencies as {source, version, hash} attrsets.";
72
89
};
73
90
options.extensions = lib.mkOption {
74
91
type = lib.types.nullOr (lib.types.listOf lib.types.str);