nix-packaging SKILL.md skillA
nix-packaging from kihara777/nixkits is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add kihara777/nixkits/nix-packaging@git:20261024.8b180c4Pins git:20261024.8b180c4 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- kihara777/nixkits
- Path
skills/nix-packaging/SKILL.md- Versions recorded
- 2
- Latest version
- git:20261024.8b180c4, committed Oct 24, 2026
- First version recorded
- Oct 21, 2026
- Size
- 5,997 bytes
- Repository stars
- 28
- License
- MIT
从零把一个上游软件打包成 Nix 表达式——按来源类型分流（GitHub 源码 / npm / Rust / 预编译二进制 / Gitea）、hash 的两段式获取（fakeHash → 读取 got → 回填 → 再构建验收）、vendored lock 的生成、wrapper 何时需要、四层验收（求值 / 真实构建 / 产物 / 运行），以及本仓（NixKits）的约定与六条实测陷阱。适用于「这个软件还没有包」的第一步，不覆盖「已有包的版本更新」（那在 nix-flake-update-check）与「提交上游」（那在 upstream-audit）。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# 从零打包 ## 判据：四层验收，缺一层就不算完成 | 层 | 判据 | 什么会骗过你 | |---|---|---| | 求值 | `nix eval .#packages.<system>.<name>.name` 得到预期版本 | 求值过 ≠ 能构建 | | 构建 | `nix build` 日志里出现 `building '…'`，**不是全缓存** | 缓存命中 = 一行没构建 | | 产物 | `ls $out/bin` 与关键文件存在 | 空 bin = 白构建 | | 运行 | `<pkg> --help` / `--version` 退出码 0 | node 无 wrapper、二进制缺库都在这一层暴露 | **「构建成功」不等于「能用」。** 前三层全绿而第四层失败，是这类工作最常见的假通过。 ## 第 1 步：按来源分流 | 来源 | 工具 | 关键点 | |---|---|---| | GitHub 源码（C/C++/CMake） | `fetchFromGitHub` + `stdenv.mkDerivation` | 布尔 flag 用 `lib.cmakeBool`，别拼字符串 | | GitHub 源码（Rust） | `rustPlatform.buildRustPackage` | `cargoHash` 同样两段式 | | GitHub 源码（npm 前端） | `buildNpmPackage` | `npmDepsHash` + vendored lock（第 3 步） | | 预编译二进制 | `fetchurl` + `stdenv.mkDerivation` | 每架构一个 hash；`autoPatchelfHook` | | Python（PyPI） | `buildPythonApplication` | `format = "pyproject"` | | **Gitea / 自托管 forge** | `fetchFromGitea` | ⚠️ `/archive/<tag>.tar.gz` 返 **403**；走 API 端点 + `stripRoot = true` | | npm registry tarball | `fetchurl` | tarball hash 与 `npmDepsHash` 是**两个**独立的 hash | ## 第 2 步：hash 两段式（核心手法） **不要猜 hash，让构建报给你。** 1. hash 写 `lib.fakeHash`（**字符串，不加括号**）； 2. 构建 → 第一处 mismatch 报 `got: sha256-…`，回填； …
Read the whole file at its exact version.
How to install
mdr add kihara777/nixkits/nix-packaging@sha256:461762035e261a70The line at the top of this page pins the label git:20261024.8b180c4, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_omtet46khcqnbsco)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Oct 21, 2026 and Oct 24, 2026, about one every 3 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261024.8b180c4 latest | 2026-10-24 | 8b180c4 | 5,997 B | A | view · diff |
| git:20261021.f5d3545 | 2026-10-21 | f5d3545 | 5,330 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (5997 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
kihara777/nixkits · 28 stars · license MIT · pushed 2026-11-06 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_omtet46khcqnbsco GET https://markdownregistry.com/api/v1/resolve?ref=kihara777/nixkits/nix-packaging GET https://markdownregistry.com/api/v1/blob/461762035e261a702cc72569dcf9b68791b8d74bebe7f3797e1dbe258124980a
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.