3 files changed, 118 insertions, 0 deletions
diff --git a/nixpkgs/pkgs/tools/nix/npins/default.nix b/nixpkgs/pkgs/tools/nix/npins/default.nix
new file mode 100644
index 000000000000..e83617da91e4
--- /dev/null
+++ b/nixpkgs/pkgs/tools/nix/npins/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, rustPlatform
+, makeWrapper
+, stdenv
+, darwin
+, callPackage
+
+  # runtime dependencies
+, nix # for nix-prefetch-url
+, nix-prefetch-git
+, git # for git ls-remote
+}:
+
+let
+  runtimePath = lib.makeBinPath [ nix nix-prefetch-git git ];
+  sources = (lib.importJSON ./sources.json).pins;
+in rustPlatform.buildRustPackage rec {
+  pname = "npins";
+  version = src.version;
+  src = passthru.mkSource sources.npins;
+
+  cargoSha256 = "sha256-eySVpmCVWBJfyAkTQv+LqojWMO/3r6kBYP1a4z+FYHY=";
+
+  buildInputs = lib.optional stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Security ]);
+  nativeBuildInputs = [ makeWrapper ];
+
+  # (Almost) all tests require internet
+  doCheck = false;
+
+  postFixup = ''
+    wrapProgram $out/bin/npins --prefix PATH : "${runtimePath}"
+  '';
+
+  meta = with lib; {
+    description = "Simple and convenient dependency pinning for Nix";
+    homepage = "https://github.com/andir/npins";
+    license = licenses.eupl12;
+    maintainers = with maintainers; [ piegames ];
+  };
+
+  passthru.mkSource = callPackage ./source.nix {};
+}
diff --git a/nixpkgs/pkgs/tools/nix/npins/source.nix b/nixpkgs/pkgs/tools/nix/npins/source.nix
new file mode 100644
index 000000000000..49046d8dd3c6
--- /dev/null
+++ b/nixpkgs/pkgs/tools/nix/npins/source.nix
@@ -0,0 +1,57 @@
+# Not part of the public API – for use within nixpkgs only
+#
+# Usage:
+# ```nix
+# let
+#   sources = lib.importJSON ./sources.json;
+# in mkMyDerivation rec {
+#   version = src.version; # This obviously only works for releases
+#   src = pkgs.npins.mkSource sources.mySource;
+# }
+# ```
+
+{ fetchgit
+, fetchzip
+, fetchurl
+}:
+let
+  mkSource = spec:
+    assert spec ? type; let
+      path =
+        if spec.type == "Git" then mkGitSource spec
+        else if spec.type == "GitRelease" then mkGitSource spec
+        else if spec.type == "PyPi" then mkPyPiSource spec
+        else if spec.type == "Channel" then mkChannelSource spec
+        else throw "Unknown source type ${spec.type}";
+    in
+    spec // { outPath = path; };
+
+  mkGitSource = { repository, revision, url ? null, hash, ... }:
+    assert repository ? type;
+    # At the moment, either it is a plain git repository (which has an url), or it is a GitHub/GitLab repository
+    # In the latter case, there we will always be an url to the tarball
+    if url != null then
+      (fetchzip {
+        inherit url;
+        sha256 = hash;
+        extension = "tar";
+      })
+    else assert repository.type == "Git"; fetchgit {
+      url = repository.url;
+      rev = revision;
+    };
+
+  mkPyPiSource = { url, hash, ... }:
+    fetchurl {
+      inherit url;
+      sha256 = hash;
+    };
+
+  mkChannelSource = { url, hash, ... }:
+    fetchzip {
+      inherit url;
+      sha256 = hash;
+      extension = "tar";
+    };
+in
+  mkSource
diff --git a/nixpkgs/pkgs/tools/nix/npins/sources.json b/nixpkgs/pkgs/tools/nix/npins/sources.json
new file mode 100644
index 000000000000..fbeb040fa74c
--- /dev/null
+++ b/nixpkgs/pkgs/tools/nix/npins/sources.json
@@ -0,0 +1,19 @@
+{
+  "pins": {
+    "npins": {
+      "type": "GitRelease",
+      "repository": {
+        "type": "GitHub",
+        "owner": "andir",
+        "repo": "npins"
+      },
+      "pre_releases": false,
+      "version_upper_bound": null,
+      "version": "0.2.2",
+      "revision": "a443c58d9c7b818aaea3c47821d7c561faef66ec",
+      "url": "https://api.github.com/repos/andir/npins/tarball/0.2.2",
+      "hash": "0rv6m8c9lmzkb76b682w7ax6jy8ls4l4y17wjx98jk64b74qspca"
+    }
+  },
+  "version": 3
+}