A Nix tool to prefetch and compute hashes for any fetcher function, enabling Trust-On-First-Use security for package sources.
nix-prefetch is a Nix command-line tool that computes and validates hashes for fixed-output derivations, such as package sources fetched from URLs or version control systems. It solves the problem of securely determining output hashes for Nix packages by implementing a Trust-On-First-Use model, which helps prevent man-in-the-middle attacks during source downloads.
Nix package maintainers and developers who need to update package hashes, create automated update scripts, or inspect fetcher arguments for packages in Nixpkgs or other Nix-based projects.
Developers choose nix-prefetch because it works with any fetcher function in the Nix ecosystem, provides security by enforcing certificate validation, and offers advanced features like store checking and comprehensive autocompletion that streamline package maintenance workflows.
Prefetch any fetcher function call, e.g. a package source
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Works with any fetcher function, including builtins like fetchurl and custom ones outside Nixpkgs, as explicitly stated in the features section.
Automatically patches fetchers to enforce certificate validation, reducing man-in-the-middle attack risks during downloads, which is a core part of its TOFU philosophy.
The --check-store option avoids redownloading sources already in the Nix store, saving time and bandwidth, as shown in examples where installed packages skip downloads.
Supports arbitrary Nix expressions and boolean flags for fetcher arguments, allowing complex use cases like --expr for lists or --no-showURLs for toggles.
Cannot extract fetcher arguments when the fetcher is not packaged as a file, as admitted in the limitations section, which may break in rare scenarios.
Requires cloning the repository and building from release.nix, unlike a simple nix-env install from Nixpkgs, adding steps for setup.
With numerous flags like --fetcher, --expr, and --check-store, plus fetcher-specific options, it can be overwhelming for users new to Nix or command-line tools.