Example: Upgrading a nixpkgs package with a new version - terraform

nix_example_upgrade_terraform.txt

# acquire nix-prefetch
$ cat > default.nix <<-"EOF"
with import <nixpkgs> { };
pkgs.mkShell rec { nativeBuildInputs = [ pkgs.nix-prefetch ]; }
EOF
$ nix-shell
# N.B.: in nix-shell my PS1 changes to (impure) *

# override terraform derivation with new source, but without sha256 and vendorSha256
(impure) * cat > terraform.nix <<-"EOF"
{ pkgs }:
pkgs.terraform_0_15.overrideAttrs (super: rec {
  name = "terraform-${version}";
  version = "1.0.0";
  src = pkgs.fetchFromGitHub {
    owner = "hashicorp";
    repo = "terraform";
    rev = "v${version}";
  };
})
EOF
# invoke nix-prefetch to determine new sha256; nix-prefetch fills in top-level pkgs appropriately in above function
(impure) * nix-prefetch "import ./terraform.nix"
# use your $EDITOR to update src according to nix-prefetch output
(impure) * perl -pi -e 's@};@  sha256 = "sha256-ddcT/I2Qn1pKFyhXgh+CcD3fSv2steSNmjyyiS2SE/o=";\n  };@' terraform.nix
# invoke nix-prefetch to determine new vendorSha256 for the go-modules
# N.B.: only required when the upstream project didn't vendor in their source tree already - in 1.0.0 terraform doesn't
(impure) * nix-prefetch "{sha256}: (import ./terraform.nix {inherit pkgs;}).go-modules.overrideAttrs(_: {vendorSha256 = sha256;})"
# update vendorSha256 according to output
(impure) * perl -pi -e 's@};@};\n  vendorSha256 = "sha256-oFvoEsDunJR4IULdGwS6nHBKWEgUehgT+nNM41W/GYo=";@' terraform.nix
# end result:
{ pkgs }:
pkgs.terraform_0_15.overrideAttrs (super: rec {
  name = "terraform-${version}";
  version = "1.0.0";
  src = pkgs.fetchFromGitHub {
    owner = "hashicorp";
    repo = "terraform";
    rev = "v${version}";
    sha256 = "sha256-ddcT/I2Qn1pKFyhXgh+CcD3fSv2steSNmjyyiS2SE/o=";
  };
  vendorSha256 = "sha256-oFvoEsDunJR4IULdGwS6nHBKWEgUehgT+nNM41W/GYo=";
})
# this should build:
(impure) * nix build --impure --expr 'with import <nixpkgs> {}; import ./terraform.nix { inherit pkgs; }'
[1/0/1 built] building terraform-1.0.0 (buildPhase): Building subPackage ./.
# looks OK
(impure) * find result/
result/
result/bin
result/bin/terraform
# remove "result" gc root
(impure) * rm result
# update default.nix to remove nix-prefetch and refer to the new package
(impure) * perl -pi -e 's@};@};\nlet terraform=import ./terraform.nix {inherit pkgs;}; in@' default.nix
(impure) * perl -pi -e 's@pkgs.nix-prefetch@terraform@' default.nix
# refresh nix-shell to reload default.nix
(impure) * exec nix-shell
# done!
(impure) * terraform version
Terraform v1.0.0
on linux_amd64