tack

flake-like toml nix pins, lazily fetched and transformed

maintains pins.toml (what you want), pins.lock.json (what's fetched), and a vendored default.nix resolver to consume locked inputs without nix's flake machinery — all tucked into ./.tack/ so your repo root stays clean.

layout

tack init creates ./.tack/ (override with $TACK_DIR) containing:

• pins.toml inputs and shorturl schemes, hand-editable
• pins.lock.json resolved inputs, written by tack update, read by nix
• default.nix the resolver; import ./.tack gives a name -> input attrset

let inputs = import ./.tack;
in inputs.nixpkgs.legacyPackages.x86_64-linux.hello

or from a flake:

outputs = { self }:
  let inputs = import ./.tack; in {
    packages.x86_64-linux.default =
      inputs.nixpkgs.legacyPackages.x86_64-linux.hello;
  };

tack warns when default.nix has drifted from the running binary, as long as the tack-managed comment at its top is present. run tack init --resolver to update it, or delete that comment to fork the resolver and silence the warning.

legacy ./inputs.nix at repo root is detected and preserved as-is.

commands

tack init [--force] [--resolver]     scaffold .tack/ (--resolver writes only default.nix)
tack update [names...] [--accept]    fetch latest, rewrite lock
tack look [names...] [--verbose|-v]  report pins with newer upstream revs
tack add <name> <url> [--fetch|--fixed [--unpack tarball|file]]
                      [--dir <d>] [--submodules] [--follows c=p]...
tack rm <name>
tack alias <name> <template>         define a shorturl scheme
tack alias --rm <name>               remove one
tack dedup                           report inputs reachable from multiple pins

tack dedup reports inputs reachable from more than one of your pins, whether direct or transitive, and recurses through the pins of your pins indefinitely. its output is two sub-blocks of ready-to-paste [all_follow] rules. the first block refers to existing top-level pins, the subsequent one refers to inputs tack will synthesise on the next tack update. targets with multiple aliases collapse into a single array entry.

pin types

• flake (default) — evaluate the input's flake.nix, expose its outputs
• fetch — source tree only, no flake eval. legacy flake = false
• fixed — hash-locked download; won't drift, tack update refuses to silently relock (use --accept if you want to)

[inputs.release]
url = "https://example.com/release-1.2.3.tar.gz"
type = "fixed"
# unpack = "tarball" | "file"   # auto-detected from the URL

url schemes

• github:owner/repo[/ref] tarball via codeload
• git+https://... / git+ssh://... any git remote; ?ref=<branch> / ?rev=<sha> to pin, submodules = true to recurse
• https://... / http://... raw tarball, where the format is inferred from the extension (e.g. .tar, .tar.gz/.tgz, .tar.xz/.txz).

shorturls

scheme:rest expands by substituting rest into the template {path}

[shorturls]
gh = "github:{path}"

[inputs.coolproject]
url = "gh:owner/coolproject"

follows

point a pin's input at one of your top-level pins instead of its own lock

[inputs.foo]
url = "gh:owner/foo"
follows = { nixpkgs = "nixpkgs" }   # foo's nixpkgs -> your nixpkgs pin

all_follow applies a rule to every pin that has a matching input. two value shapes are accepted:

[all_follow]
# alias -> target. every input named fenix follows your top-level fenix pin
fenix = "fenix"

# target -> [aliases]. the key is the canonical target, and the key plus every
# array member alias to it. one row covers many aliases of the same target
nixpkgs = ["nixpkgs-stable", "nixpkgs-unstable"]

[inputs.bar]
url = "gh:owner/bar"
exclude_follow = ["nixpkgs"]   # ...except bar's

when a target named in [all_follow] isn't itself a top-level [inputs] pin, tack update synthesises a lock entry for it by walking every top-level flake.lock, collecting the observed revs of the aliased name, and writing the freshest by lastModified into pins.lock.json. the resolver then treats the synthetic entry as a default flake, or as a bare source tree when its repo has no flake.nix. this lets you dedup transitive inputs (e.g. crane) without declaring them as top-level pins you don't actually consume.

build

nix develop   # rust toolchain + openssl/libgit2
nix build     # the binary

license

EUPL-1.2. see LICENSE