mykiwi/mykiwi.blogpublic Fork 0
bf3cf90170888299b6939d18c034327377a52922
Commits
Clone
git clone https://git.rickub.com/mykiwi/mykiwi.blog.git
git clone ssh://git@rickub.com/mykiwi/mykiwi.blog.git

Host key fingerprint (ed25519): SHA256:iycHnxEyq0Q7uyVpB7JlznP0G7JrTPXLYRcAU5CSLhc — verify it before your first connect.

Add the first three posts bf3cf90 · on bf3cf90170888299b6939d18c034327377a52922 · Romain Gautier · 15h ago
nix-flakes-for-reproducible-builds.md · 27 lines · 775 Bmarkdown
Blame HistoryOpen raw

+++
date = '2026-02-14T10:30:00+01:00'
draft = false
title = 'Nix Flakes for Reproducible Builds'
summary = 'Notes on pinning tool versions with Nix flakes.'
+++

Nix flakes make it easy to pin exact versions of dependencies, like the Hugo
binary used to build this blog, so every contributor gets identical builds
without relying on a system-wide package manager.

Pinning Hugo

The flake.nix in this repo pins an exact Hugo release through
nixpkgs-multiverse:

hugo = mv.version "hugo" "0.166.0";

Running nix develop drops that version onto PATH, and nix build uses
the same pin to produce the site.

{{% alert "tip" %}}
Tip: Pin the version once, in one file, and every machine that runs
nix build gets byte-identical output.
{{% /alert %}}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
+++
date = '2026-02-14T10:30:00+01:00'
draft = false
title = 'Nix Flakes for Reproducible Builds'
summary = 'Notes on pinning tool versions with Nix flakes.'
+++

Nix flakes make it easy to pin exact versions of dependencies, like the Hugo
binary used to build this blog, so every contributor gets identical builds
without relying on a system-wide package manager.

## Pinning Hugo

The `flake.nix` in this repo pins an exact Hugo release through
`nixpkgs-multiverse`:

```nix
hugo = mv.version "hugo" "0.166.0";
```

Running `nix develop` drops that version onto `PATH`, and `nix build` uses
the same pin to produce the site.

{{% alert "tip" %}}
**Tip:** Pin the version once, in one file, and every machine that runs
`nix build` gets byte-identical output.
{{% /alert %}}