Nix fetchTarball with SHA256 sum checking

fetch-tar.nix

# We expect the tarball to only contain a single directory, the
# same way that the builtin `fetchTarball' does.

{ stdenv, nix }:

{ url,
  # Name we label this derivation with.
  name,
  # Hash of *extracted output directory*,
  # as generated by `nix-hash --type sha256 --base32'.
  sha256
}:

stdenv.mkDerivation {
  inherit name sha256;
  tarfile = builtins.fetchurl url;

  buildInputs = [ nix ];
  builder = ./fetchTar.sh;
}

fetchTar.sh

source $stdenv/setup

# We're currently in a temporary directory which we can use to
# extract the tar file and check its hash.

mkdir ./extract
tar -xf $tarfile -C ./extract

EXTRACTED=$(echo ./extract/*)

>&2 echo "checking hash of $TMPDIR/$EXTRACTED/..."

HASH=$(nix-hash --type sha256 --base32 $EXTRACTED)

if [ "$HASH" != "$sha256" ]; then
  >&2 echo "  got sha256 hash \`$HASH'"
  >&2 echo "  but expected hash \`$sha256'"
  exit 1
fi

mv -f $EXTRACTED $out