manic-systems / tack

What is tack?

Tack is a Rust tool that brings flake-style dependency pinning to Nix projects without requiring the flake system itself. You write your dependencies in `pins.toml` (plain TOML), run `tack update` to fetch and lock them, then import `inputs.nix` directly in your Nix config or flake. It handles GitHub URLs, arbitrary git remotes, submodule fetching, and computes NAR hashes that match Nix's own `builtins.fetchTree` output. The CLI covers the full workflow: `init`, `update`, `look` (check for upstream updates), `add`, `rm`, and `alias` for defining URL shortcuts like `gh:owner/repo`.

Why is it gaining traction?

The Nix community has love-hate relationship with flakes. Tack offers the pinning workflow developers actually want—versioned dependencies, lock files, reproducible builds—without the flakes machinery. The `follows` feature is particularly clever: you can redirect any pin's internal dependencies to your own top-level pins, avoiding duplicate fetches of nixpkgs across every input. The drift detection is a nice safety net—when a commit hash stays the same but the tree content differs, tack warns you before blindly relocking. It's lazy (fetches on demand), fast (parallel fetching), and outputs Nix-compatible lock files you can version control.

Who should use this?

Nix users frustrated by flakes' constraints or working in environments where flakes are disabled. DevOps teams managing multi-repository setups who want consistent dependency pinning without adopting the full flake ecosystem. Anyone who prefers writing TOML over JSON for human-editable config. Not for beginners—understanding how Nix inputs work is assumed.

Verdict

The concept is solid and the implementation is thoughtful, but this is extremely early-stage: 19 stars, version 0.1.0, and edition 2024 (unstable Rust). The credibility score of 1.0% reflects that reality. If you're deep in the Nix ecosystem and want flake-free pinning, it's worth watching—but hold off on production use until it accumulates more battle-testing and community adoption.