# Nixtamal Manifest(5)() | Nixtamal ┏┓╻+╻ ╱┏┳┓┏┓┏┳┓┏┓╻ ┃┃┃┃┗━┓╹┃╹┣┫┃┃┃┣┫┃ ╹┗┛╹╱ ╹ ╹ ╹╹╹ ╹╹╹┗┛ Home Install Manpage Changelog Roadmap Cookbook Real-world showcase Community FAQs Funding Nixtamal Manifest(5)() Name Nixtamal Manifest(5) - Setting up for pinning down inputs Synopsis Nixtamal uses KDL for its manifest describing inputs. At the highest level, this includes: manifest version default hashing algorithm patches (optional) list of inputs the input kind & its specific attributes a command to check if ‘fresh’ hashing information patches to apply to the input Note: A KDL Schema file is shipped alongside this documentation for use with schema-aware editors and validators. It can be found in the installation directory under share/nixtamal/manifest.kdl . Default manifest.kdl version "0.5.0" inputs { nixpkgs { archive { url "https://github.com/NixOS/nixpkgs/archive/{{fresh_value}}.tar.gz" } hash algorithm=SHA-256 fetch-time eval fresh-cmd { $ git ls-remote "https://github.com/NixOS/nixpkgs.git" --refs "refs/heads/nixos-unstable" | cut -f1 } } } Top-level nodes version Version of the Nixtamal spec the manifest.kdl is using. default-hash-algorithm Hash algorithm to use by default for inputs when the input does not note its hash algorithm. Defaults to SHA-256 . patches Map of patches to be applied to inputs where the patch name should be unique. Each patch has a URL (first argument). See Patches. default-fetch-time Default fetch time for inputs when not specified at the input level. Can be eval (fetch during Nix evaluation using builtins.fetch* ) or build (fetch during build using pkgs.fetch* ). Defaults to eval . inputs Map of inputs to be pinned where the input+node name should be unique & will be used in the Nix output as well as logs & errors. See Input node. Fetch Time Inputs can be fetched either during Nix evaluation or during build time: eval Fetch the input during Nix evaluation using builtins.fetch* functions. This is the default behavior and is suitable for inputs that need to be available during evaluation, such as the bootstrap Nixpkgs. build Fetch the input during build time using pkgs.fetch* functions. This is suitable for most inputs and allows for better caching and parallel fetching. The fetch time can be set globally using default-fetch-time or per-input using the fetch-time property on file , archive , and git input types. Caution!: Inputs with patches cannot use eval fetch time, as patches are applied during build time. The system will automatically enforce this constraint. Patches Patches are defined at the top-level and can be applied to any input. This allows defining a patch once and applying it to multiple inputs. url Templated node URL or file reference for the patch. Supports https:// , http:// , and file:// URLs. hash Optional node for hash algorithm information. The algorithm property will be used when prefetching, locking, & for integrity verification. The optional expected property may be used to assert a known hash. If not specified, no hash verification is performed. Defaults to the top-level default-hash-algorithm or SHA-256 . Input node At a high level these should be seen as prop: frozen A boolean ( frozen=#true ) that prevents trying refresh or otherwise get a new fresh value for this input. “kind” There are specific nodes for each different type of supported fetchers/prefetchers: file , archive , git , darcs , pijul , fossil (with more to come in the future). hash An optional node for hash algorithm information for a input. The algorithm property will be used when prefetching, locking, & for importing (which falls back to top-level default-hash-algorithm or defined default SHA-256 ). The optional expected property may be used to assert a known hash. Caution!: The bootstrapping Nixpkgs pin (either manually set or using nixpkgs-nixtamal or nixpkgs as defaults) must be SHA-256 to be compatible with builtins.fetchTarball . fresh-cmd Command (with or without pipes using $ & | nodes) that can shelled out to to return a string that will be locked as the fresh command value which can be used both to prevent unnecessary prefectching, but also for use in a Templated node. patches List of patch names (as arguments) to apply to this input. Patches are defined at the top-level in the Patches section. File prop: fetch-time Property to set when to fetch this input: eval or build . Defaults to the top-level default-fetch-time or build . url Templated node URL reference for the input mirrors Templated node URL mirror references for the input Archive prop: fetch-time Property to set when to fetch this input: eval or build . Defaults to the top-level default-fetch-time or build . url Templated node URL reference for the input mirrors Templated node URL mirror references for the input Git prop: fetch-time Property to set when to fetch this input: eval or build . Defaults to the top-level default-fetch-time or build . repository Templated node repository reference for the input mirrors Templated node repository mirror references for the input Warning: Probably not yet supported upstream. "reference" branch or tag or ref node as the reference point for getting stable reference. tag provides convenience over using ref with full tag paths. submodules Leaf node for enabling submodules on a repository lfs Leaf node for enabling Git LFS on a repository Darcs repository Templated node repository reference for the input mirrors Templated node repository mirror references for the input Note: Recently upstreamed. See: “reference” context or tag node as the reference point for getting stable reference; in the case of Darcs, if neither is supplied a context will be assumed & copied from nix-prefetch-darcs Pijul remote Templated node remote reference for the input mirrors Templated node remote mirror references for the input Note: Recently upstreamed. See: “reference” channel or state or change (not recommended) node as the reference point for getting stable reference; if unsure, try channel main Fossil repository Templated node repository reference for the input “reference” branch or tag or check-in node as the reference point for getting stable reference Templated node Some nodes have values with string substitution via Jingoo , which is probably overkill, but could give you flexibilty with if statements. The templated nodes include: inputs >> file > url inputs >> file > mirrors inputs >> archive > url inputs >> archive > mirrors inputs >> git > repository inputs >> git > mirrors inputs >> darcs > repository inputs >> darcs > mirrors inputs >> pijul > remote inputs >> pijul > mirrors inputs >> fossil > repository inputs >> fresh-cmd > $ inputs >> fresh-cmd > | The input kind affects the values for substition: file Key Type Description name string input name fresh_value string nullable fresh command return value archive Key Type Description name string input name fresh_value string nullable fresh command return value git Key Type Description name string input name fresh_value string nullable fresh command return value branch string nullable branch name ref string nullable reference name datetime string nullable Datetime of latest revision lfs bool repository uses LFS submodules bool repository uses submodules rev / revision string nullable latest revision darcs Key Type Description name string input name fresh_value string nullable fresh command return value context string nullable path to context file tag string nullable tag datetime string nullable datetime of latest patch weak_hash string nullable latest weak hash of the repository pijul Key Type Description name string input name fresh_value string nullable fresh command return value channel string nullable remote channel change string nullable change datetime string nullable datetime of latest patch state string nullable latest state of the remote or supplied state fossil Key Type Description name string input name fresh_value string nullable fresh command return value branch string nullable branch name tag string nullable tag checkin string nullable check-in date string nullable date of latest patch Input showcase Darcs using exposed WeakHash to avoid needless refresh nixtamal { darcs { repository "https://darcs.toastal.in.th/nixtamal/stable/" mirrors "https://smeder.ee/~toastal/nixtamal.darcs" } fresh-cmd { $ curl -sL "https://darcs.toastal.in.th/nixtamal/stable/_darcs/weak_hash" } } Local directory checking for latest modification soupault-plugins { file { url "file:///home/toastal/my-project" } fresh-cmd { $ find "/home/toastal/my-project" "-print0" | xargs "-0" stat -c %Y | sort -n | tail -n1 } } Eval time file with mirror + templated nodes mozilla-tls-guidelines { file fetch-time=eval { url "https://ssl-config.mozilla.org/guidelines/{{fresh_value}}.json" mirrors "https://raw.githubusercontent.com/mozilla/ssl-config-generator/refs/tags/v{{fresh_value}}/src/static/guidelines/{{fresh_value}}.json" } fresh-cmd { $ curl -sL "https://wiki.mozilla.org/Security/Server_Side_TLS" | htmlq -w -t "table.wikitable:last-of-type > tbody > tr:nth-child(2) > td:first-child" | head -n1 } } Basic Pijul with BLAKE3 hash pijul { pijul { remote "https://nest.pijul.com/pijul/pijul" channel main } hash algorithm=BLAKE3 } Inputs with patches patches { nixpkgs-pr123 "https://github.com/NixOS/nixpkgs/pull/123.diff" my-fix "./patches/my-fix.patch" } inputs { nixpkgs { git { repository "https://github.com/NixOS/nixpkgs.git" ref "refs/heads/nixos-unstable" } patches "nixpkgs-pr123" "my-fix" } nixpkgs-stable { git { repository "https://github.com/NixOS/nixpkgs.git" ref "refs/heads/nixos-24.05" } patches "my-fix" } } Local patches (starting with ./ or ../ ) are applied directly from the repository and & be tracked by your VCS. “Remote” patches (meaning not local to the repository such as HTTPS, absolute paths with file: , & so forth) are fetched & hashed during nixtamal lock . Author toastal 0.5.0 Site made with Nix ( dep management), Nickel ( config ), Soupault ( SSG ), Docutils ( rST rendering), mandoc (manpage conversion), & sugilite256 (color scheme). © 2025–2026 toastal . © 2026 Nixtamal contributors. Some rights reserved. Except where otherwise noted, the content on this website is licensed under CC-BY-SA-4.0 . Citations must attribute the work’s writer/maker & include a hyperlink to this website (or rather the work itself). Yes, these rules/clauses apply to LLM s & AI assistants too.