push sheeet

pkgs/build-support/node/fetch-yarn-deps/common.js

@@ -0,0 +1,19 @@
+const path = require('path')
+
+// This has to match the logic in pkgs/development/tools/yarn2nix-moretea/yarn2nix/lib/urlToName.js
+// so that fixup_yarn_lock produces the same paths
+const urlToName = url => {
+  const isCodeloadGitTarballUrl = url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')
+
+  if (url.startsWith('file:')) {
+    return url
+  } else if (url.startsWith('git+') || isCodeloadGitTarballUrl) {
+    return path.basename(url)
+  } else {
+    return url
+      .replace(/https:\/\/(.)*(.com)\//g, '') // prevents having long directory names
+      .replace(/[@/%:-]/g, '_') // replace @ and : and - and % characters with underscore
+  }
+}
+
+module.exports = { urlToName };

pkgs/build-support/node/fetch-yarn-deps/default.nix

@@ -0,0 +1,199 @@
+{
+  stdenv,
+  lib,
+  makeWrapper,
+  installShellFiles,
+  nodejsInstallManuals,
+  nodejsInstallExecutables,
+  coreutils,
+  nix-prefetch-git,
+  fetchurl,
+  jq,
+  nodejs,
+  nodejs-slim,
+  prefetch-yarn-deps,
+  fixup-yarn-lock,
+  diffutils,
+  yarn,
+  makeSetupHook,
+  cacert,
+  callPackage,
+}:
+
+let
+  yarnpkg-lockfile-tar = fetchurl {
+    url = "https://registry.yarnpkg.com/@yarnpkg/lockfile/-/lockfile-1.1.0.tgz";
+    hash = "sha512-GpSwvyXOcOOlV70vbnzjj4fW5xW/FdUF6nQEt1ENy7m4ZCczi1+/buVUPAqmGfqznsORNFzUMjctTIp8a9tuCQ==";
+  };
+
+  tests = callPackage ./tests { };
+in
+{
+  prefetch-yarn-deps = stdenv.mkDerivation {
+    name = "prefetch-yarn-deps";
+
+    dontUnpack = true;
+    dontBuild = true;
+
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ nodejs-slim ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/bin $out/libexec
+
+      tar --strip-components=1 -xf ${yarnpkg-lockfile-tar} package/index.js
+      mv index.js $out/libexec/yarnpkg-lockfile.js
+      cp ${./common.js} $out/libexec/common.js
+      cp ${./index.js} $out/libexec/index.js
+
+      patchShebangs $out/libexec
+      makeWrapper $out/libexec/index.js $out/bin/prefetch-yarn-deps \
+        --prefix PATH : ${
+          lib.makeBinPath [
+            coreutils
+            nix-prefetch-git
+          ]
+        }
+
+      runHook postInstall
+    '';
+
+    passthru = {
+      inherit tests;
+    };
+  };
+
+  fixup-yarn-lock = stdenv.mkDerivation {
+    name = "fixup-yarn-lock";
+
+    dontUnpack = true;
+    dontBuild = true;
+
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ nodejs-slim ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/bin $out/libexec
+
+      tar --strip-components=1 -xf ${yarnpkg-lockfile-tar} package/index.js
+      mv index.js $out/libexec/yarnpkg-lockfile.js
+      cp ${./common.js} $out/libexec/common.js
+      cp ${./fixup.js} $out/libexec/fixup.js
+
+      patchShebangs $out/libexec
+      makeWrapper $out/libexec/fixup.js $out/bin/fixup-yarn-lock
+
+      runHook postInstall
+    '';
+
+    passthru = {
+      inherit tests;
+    };
+  };
+
+  fetchYarnDeps =
+    let
+      f =
+        {
+          name ? "offline",
+          src ? null,
+          hash ? "",
+          sha256 ? "",
+          ...
+        }@args:
+        let
+          hash_ =
+            if hash != "" then
+              {
+                outputHashAlgo = null;
+                outputHash = hash;
+              }
+            else if sha256 != "" then
+              {
+                outputHashAlgo = "sha256";
+                outputHash = sha256;
+              }
+            else
+              {
+                outputHashAlgo = "sha256";
+                outputHash = lib.fakeSha256;
+              };
+        in
+        stdenv.mkDerivation (
+          {
+            inherit name;
+
+            dontUnpack = src == null;
+            dontInstall = true;
+
+            nativeBuildInputs = [
+              prefetch-yarn-deps
+              cacert
+            ];
+            GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+            NODE_EXTRA_CA_CERTS = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+            buildPhase = ''
+              runHook preBuild
+
+              yarnLock=''${yarnLock:=$PWD/yarn.lock}
+              mkdir -p $out
+              (cd $out; prefetch-yarn-deps --verbose --builder $yarnLock)
+
+              runHook postBuild
+            '';
+
+            outputHashMode = "recursive";
+          }
+          // hash_
+          // (removeAttrs args (
+            [
+              "name"
+              "hash"
+              "sha256"
+            ]
+            ++ (lib.optional (src == null) "src")
+          ))
+        );
+    in
+    lib.setFunctionArgs f (lib.functionArgs f) // { inherit tests; };
+
+  yarnConfigHook = makeSetupHook {
+    name = "yarn-config-hook";
+    propagatedBuildInputs = [
+      yarn
+      fixup-yarn-lock
+    ];
+    substitutions = {
+      # Specify `diff` by abspath to ensure that the user's build
+      # inputs do not cause us to find the wrong binaries.
+      diff = "${diffutils}/bin/diff";
+    };
+    meta = {
+      description = "Install nodejs dependencies from an offline yarn cache produced by fetchYarnDeps";
+    };
+  } ./yarn-config-hook.sh;
+
+  yarnBuildHook = makeSetupHook {
+    name = "yarn-build-hook";
+    meta = {
+      description = "Run yarn build in buildPhase";
+    };
+  } ./yarn-build-hook.sh;
+
+  yarnInstallHook = makeSetupHook {
+    name = "yarn-install-hook";
+    propagatedBuildInputs = [
+      yarn
+      nodejsInstallManuals
+      nodejsInstallExecutables
+    ];
+    substitutions = {
+      jq = lib.getExe jq;
+    };
+  } ./yarn-install-hook.sh;
+}

pkgs/build-support/node/fetch-yarn-deps/fixup.js

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+'use strict'
+
+const fs = require('fs')
+const process = require('process')
+const lockfile = require('./yarnpkg-lockfile.js')
+const { urlToName } = require('./common.js')
+
+const fixupYarnLock = async (lockContents, verbose) => {
+  const lockData = lockfile.parse(lockContents)
+
+  const fixedData = Object.fromEntries(
+    Object.entries(lockData.object)
+    .map(([dep, pkg]) => {
+      if (pkg.resolved === undefined) {
+        console.warn(`no resolved URL for package ${dep}`)
+        var maybeFile = dep.split("@", 2)[1]
+        if (maybeFile.startsWith("file:")) {
+          console.log(`Rewriting URL for local file dependency ${dep}`)
+          pkg.resolved = maybeFile
+        }
+        return [dep, pkg]
+      }
+      const [ url, hash ] = pkg.resolved.split("#", 2)
+
+      if (hash || url.startsWith("https://codeload.github.com/")) {
+        if (verbose) console.log(`Removing integrity for git dependency ${dep}`)
+        delete pkg.integrity
+      }
+
+      if (verbose) console.log(`Rewriting URL ${url} for dependency ${dep}`)
+      pkg.resolved = urlToName(url)
+      if (hash)
+        pkg.resolved += `#${hash}`
+
+      return [dep, pkg]
+    })
+  )
+
+  if (verbose) console.log('Done')
+
+  return fixedData
+}
+
+const showUsage = async () => {
+  process.stderr.write(`
+syntax: fixup-yarn-lock [path to yarn.lock] [options]
+
+Options:
+  -h --help         Show this help
+  -v --verbose      Verbose output
+`)
+  process.exit(1)
+}
+
+const main = async () => {
+  const args = process.argv.slice(2)
+  let next, lockFile, verbose
+  while (next = args.shift()) {
+    if (next == '--verbose' || next == '-v') {
+      verbose = true
+    } else if (next == '--help' || next == '-h') {
+      showUsage()
+    } else if (!lockFile) {
+      lockFile = next
+    } else {
+      showUsage()
+    }
+  }
+  let lockContents
+  try {
+    lockContents = await fs.promises.readFile(lockFile || 'yarn.lock', 'utf-8')
+  } catch {
+    showUsage()
+  }
+
+  const fixedData = await fixupYarnLock(lockContents, verbose)
+  await fs.promises.writeFile(lockFile || 'yarn.lock', lockfile.stringify(fixedData))
+}
+
+main()
+  .catch(e => {
+    console.error(e)
+    process.exit(1)
+  })

pkgs/build-support/node/fetch-yarn-deps/index.js

@@ -0,0 +1,223 @@
+#!/usr/bin/env node
+'use strict'
+
+const fs = require('fs')
+const crypto = require('crypto')
+const process = require('process')
+const https = require('https')
+const child_process = require('child_process')
+const path = require('path')
+const lockfile = require('./yarnpkg-lockfile.js')
+const { promisify } = require('util')
+const url = require('url')
+const { URL } = url;
+const { urlToName } = require('./common.js')
+
+const execFile = promisify(child_process.execFile)
+
+const exec = async (...args) => {
+  const res = await execFile(...args)
+  if (res.error) throw new Error(res.stderr)
+  return res
+}
+
+const downloadFileHttps = (fileName, url, expectedHash, verbose, hashType = 'sha1') => {
+  return new Promise((resolve, reject) => {
+    const get = (url, redirects = 0) => https.get(url, (res) => {
+      if(redirects > 10) {
+        reject('Too many redirects!');
+        return;
+      }
+      if(res.statusCode === 301 || res.statusCode === 302) {
+        const location = new URL(res.headers.location, url);
+        if (verbose) console.log('following redirect to ' + location);
+        return get(location, redirects + 1);
+      }
+      const file = fs.createWriteStream(fileName)
+      const hash = crypto.createHash(hashType)
+      res.pipe(file)
+      res.pipe(hash).setEncoding('hex')
+      res.on('end', () => {
+        file.close()
+        const h = hash.read()
+        if (expectedHash === undefined){
+          console.log(`Warning: lockfile url ${url} doesn't end in "#<hash>" to validate against. Downloaded file had hash ${h}.`);
+        } else if (h != expectedHash) return reject(new Error(`hash mismatch, expected ${expectedHash}, got ${h} for ${url}`))
+        resolve()
+      })
+      res.on('error', e => reject(e))
+    })
+    get(url)
+  })
+}
+
+const downloadGit = async (fileName, url, rev) => {
+  await exec('nix-prefetch-git', [
+    '--out', fileName + '.tmp',
+    '--url', url,
+    '--rev', rev,
+    '--builder'
+  ])
+
+  await exec('tar', [
+    // hopefully make it reproducible across runs and systems
+    '--owner=0', '--group=0', '--numeric-owner', '--format=gnu', '--sort=name', '--mtime=@1',
+
+    // Set u+w because tar-fs can't unpack archives with read-only dirs: https://github.com/mafintosh/tar-fs/issues/79
+    '--mode', 'u+w',
+
+    '-C', fileName + '.tmp',
+    '-cf', fileName, '.'
+  ])
+
+  await exec('rm', [ '-rf', fileName + '.tmp', ])
+}
+
+const isGitUrl = pattern => {
+  // https://github.com/yarnpkg/yarn/blob/3119382885ea373d3c13d6a846de743eca8c914b/src/resolvers/exotics/git-resolver.js#L15-L47
+  const GIT_HOSTS = ['github.com', 'gitlab.com', 'bitbucket.com', 'bitbucket.org']
+  const GIT_PATTERN_MATCHERS = [/^git:/, /^git\+.+:/, /^ssh:/, /^https?:.+\.git$/, /^https?:.+\.git#.+/]
+
+  for (const matcher of GIT_PATTERN_MATCHERS) if (matcher.test(pattern)) return true
+
+  const {hostname, path} = url.parse(pattern)
+  if (hostname && path && GIT_HOSTS.indexOf(hostname) >= 0
+    // only if dependency is pointing to a git repo,
+    // e.g. facebook/flow and not file in a git repo facebook/flow/archive/v1.0.0.tar.gz
+    && path.split('/').filter(p => !!p).length === 2
+  ) return true
+
+  return false
+}
+
+const downloadPkg = (pkg, verbose) => {
+  for (let marker of ['@file:', '@link:']) {
+    const split = pkg.key.split(marker)
+    if (split.length == 2) {
+      console.info(`ignoring lockfile entry "${split[0]}" which points at path "${split[1]}"`)
+      return
+    } else if (split.length > 2) {
+      throw new Error(`The lockfile entry key "${pkg.key}" contains "${marker}" more than once. Processing is not implemented.`)
+    }
+  }
+
+  if (pkg.resolved === undefined) {
+    throw new Error(`The lockfile entry with key "${pkg.key}" cannot be downloaded because it is missing the "resolved" attribute, which should contain the URL to download from. The lockfile might be invalid.`)
+  }
+
+  const [ url, hash ] = pkg.resolved.split('#')
+  if (verbose) console.log('downloading ' + url)
+  const fileName = urlToName(url)
+  const s = url.split('/')
+  if (url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')) {
+    return downloadGit(fileName, `https://github.com/${s[3]}/${s[4]}.git`, s[s.length-1])
+  } else if (url.startsWith('https://github.com/') && url.endsWith('.tar.gz') &&
+    (
+      s.length <= 5 ||    // https://github.com/owner/repo.tgz#feedface...
+      s[5] == "archive"   // https://github.com/owner/repo/archive/refs/tags/v0.220.1.tar.gz
+    )) {
+    return downloadGit(fileName, `https://github.com/${s[3]}/${s[4]}.git`, s[s.length-1].replace(/.tar.gz$/, ''))
+  } else if (isGitUrl(url)) {
+    return downloadGit(fileName, url.replace(/^git\+/, ''), hash)
+  } else if (url.startsWith('https://')) {
+    if (typeof pkg.integrity === 'string' || pkg.integrity instanceof String) {
+      const [ type, checksum ] = pkg.integrity.split('-')
+      return downloadFileHttps(fileName, url, Buffer.from(checksum, 'base64').toString('hex'), verbose, type)
+    }
+    return downloadFileHttps(fileName, url, hash, verbose)
+  } else if (url.startsWith('file:')) {
+    console.warn(`ignoring unsupported file:path url "${url}"`)
+  } else {
+    throw new Error('don\'t know how to download "' + url + '"')
+  }
+}
+
+const performParallel = tasks => {
+  const worker = async () => {
+    while (tasks.length > 0) await tasks.shift()()
+  }
+
+  const workers = []
+  for (let i = 0; i < 4; i++) {
+    workers.push(worker())
+  }
+
+  return Promise.all(workers)
+}
+
+// This could be implemented using [`Map.groupBy`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map/groupBy),
+// but that method is only supported starting with Node 21
+const uniqueBy = (arr, callback) => {
+  const map = new Map()
+  for (const elem of arr) {
+    map.set(callback(elem), elem)
+  }
+  return [...map.values()]
+}
+
+const prefetchYarnDeps = async (lockContents, verbose) => {
+  const lockData = lockfile.parse(lockContents)
+  await performParallel(
+    uniqueBy(Object.entries(lockData.object), ([_, value]) => value.resolved)
+    .map(([key, value]) => () => downloadPkg({ key, ...value }, verbose))
+  )
+  await fs.promises.writeFile('yarn.lock', lockContents)
+  if (verbose) console.log('Done')
+}
+
+const showUsage = async () => {
+  process.stderr.write(`
+syntax: prefetch-yarn-deps [path to yarn.lock] [options]
+
+Options:
+  -h --help         Show this help
+  -v --verbose      Verbose output
+  --builder         Only perform the download to current directory, then exit
+`)
+  process.exit(1)
+}
+
+const main = async () => {
+  const args = process.argv.slice(2)
+  let next, lockFile, verbose, isBuilder
+  while (next = args.shift()) {
+    if (next == '--builder') {
+      isBuilder = true
+    } else if (next == '--verbose' || next == '-v') {
+      verbose = true
+    } else if (next == '--help' || next == '-h') {
+      showUsage()
+    } else if (!lockFile) {
+      lockFile = next
+    } else {
+      showUsage()
+    }
+  }
+  let lockContents
+  try {
+    lockContents = await fs.promises.readFile(lockFile || 'yarn.lock', 'utf-8')
+  } catch {
+    showUsage()
+  }
+
+  if (isBuilder) {
+    await prefetchYarnDeps(lockContents, verbose)
+  } else {
+    const { stdout: tmpDir } = await exec('mktemp', [ '-d' ])
+
+    try {
+      process.chdir(tmpDir.trim())
+      await prefetchYarnDeps(lockContents, verbose)
+      const { stdout: hash } = await exec('nix-hash', [ '--type', 'sha256', '--base32', tmpDir.trim() ])
+      console.log(hash)
+    } finally {
+      await exec('rm', [ '-rf', tmpDir.trim() ])
+    }
+  }
+}
+
+main()
+  .catch(e => {
+    console.error(e)
+    process.exit(1)
+  })

pkgs/build-support/node/fetch-yarn-deps/tests/default.nix

@@ -0,0 +1,28 @@
+{ testers, fetchYarnDeps, ... }:
+
+{
+  file = testers.invalidateFetcherByDrvHash fetchYarnDeps {
+    yarnLock = ./file.lock;
+    sha256 = "sha256-BPuyQVCbdpFL/iRhmarwWAmWO2NodlVCOY9JU+4pfa4=";
+  };
+  simple = testers.invalidateFetcherByDrvHash fetchYarnDeps {
+    yarnLock = ./simple.lock;
+    sha256 = "sha256-FRrt8BixleILmFB2ZV8RgPNLqgS+dlH5nWoPgeaaNQ8=";
+  };
+  gitDep = testers.invalidateFetcherByDrvHash fetchYarnDeps {
+    yarnLock = ./git.lock;
+    sha256 = "sha256-f90IiEzHDiBdswWewRBHcJfqqpPipaMg8N0DVLq2e8Q=";
+  };
+  githubDep = testers.invalidateFetcherByDrvHash fetchYarnDeps {
+    yarnLock = ./github.lock;
+    sha256 = "sha256-DIKrhDKoqm7tHZmcuh9eK9VTqp6BxeW0zqDUpY4F57A=";
+  };
+  githubReleaseDep = testers.invalidateFetcherByDrvHash fetchYarnDeps {
+    yarnLock = ./github-release.lock;
+    sha256 = "sha256-g+y/H6k8LZ+IjWvkkwV7JhKQH1ycfeqzsIonNv4fDq8=";
+  };
+  gitUrlDep = testers.invalidateFetcherByDrvHash fetchYarnDeps {
+    yarnLock = ./giturl.lock;
+    sha256 = "sha256-VPnyqN6lePQZGXwR7VhbFnP7/0/LB621RZwT1F+KzVQ=";
+  };
+}

pkgs/build-support/node/fetch-yarn-deps/tests/file.lock

@@ -0,0 +1,9 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"@org/somepack@file:vendor/orgpacks/somepack/assets":
+  version "1.0.0"
+
+"otherpack@file:vendor/otherpack":
+  version "1.0.0"

pkgs/build-support/node/fetch-yarn-deps/tests/git.lock

@@ -0,0 +1,7 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"async@git+https://github.com/caolan/async":
+  version "3.2.1"
+  resolved "git+https://github.com/caolan/async#fc9ba651341af5ab974aade6b1640e345912be83"

pkgs/build-support/node/fetch-yarn-deps/tests/github-release.lock

@@ -0,0 +1,6 @@
+"libsession_util_nodejs@https://github.com/oxen-io/libsession-util-nodejs/releases/download/v0.3.19/libsession_util_nodejs-v0.3.19.tar.gz":
+  version "0.3.19"
+  resolved "https://github.com/oxen-io/libsession-util-nodejs/releases/download/v0.3.19/libsession_util_nodejs-v0.3.19.tar.gz#221c1fc34fcc18601aea4ce1b733ebfa55af66ea"
+  dependencies:
+    cmake-js "^7.2.1"
+    node-addon-api "^6.1.0"

pkgs/build-support/node/fetch-yarn-deps/tests/github.lock

@@ -0,0 +1,7 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"async@github:caolan/async":
+  version "3.2.1"
+  resolved "https://codeload.github.com/caolan/async/tar.gz/fc9ba651341af5ab974aade6b1640e345912be83"

pkgs/build-support/node/fetch-yarn-deps/tests/giturl.lock

@@ -0,0 +1,11 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"autocomplete-atom-api@https://codeload.github.com/atom/autocomplete-atom-api/legacy.tar.gz/refs/tags/v0.10.7":
+  version "0.10.7"
+  resolved "https://codeload.github.com/atom/autocomplete-atom-api/legacy.tar.gz/refs/tags/v0.10.7#c9d51fa721d543ccfc1b2189101155e81db6b97d"
+
+"find-and-replace@https://github.com/atom-community/find-and-replace/archive/refs/tags/v0.220.1.tar.gz":
+  version "0.220.1"
+  resolved "https://github.com/atom-community/find-and-replace/archive/refs/tags/v0.220.1.tar.gz#d7a0f56511e38ee72a89895a795bbbcab4a1a405"

pkgs/build-support/node/fetch-yarn-deps/tests/simple.lock

@@ -0,0 +1,8 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+lit-html@1:
+  version "1.4.1"
+  resolved "https://registry.yarnpkg.com/lit-html/-/lit-html-1.4.1.tgz#0c6f3ee4ad4eb610a49831787f0478ad8e9ae5e0"
+  integrity sha512-B9btcSgPYb1q4oSOb/PrOT6Z/H+r6xuNzfH4lFli/AWhYwdtrgQkQWBbIc6mdnf6E2IL3gDXdkkqNktpU0OZQA==

pkgs/build-support/node/fetch-yarn-deps/yarn-build-hook.sh

@@ -0,0 +1,24 @@
+yarnBuildHook() {
+    runHook preBuild
+    echo "Executing yarnBuildHook"
+
+    if [ -z "${yarnBuildScript-}" ]; then
+        yarnBuildScript="build"
+    fi
+
+    if ! type node > /dev/null 2>&1 ; then
+        echo yarnConfigHook WARNING: a node interpreter was not added to the \
+            build, and is probably required to run \'yarn $yarnBuildHook\'. \
+            A common symptom of this is getting \'command not found\' errors \
+            for Nodejs related tools.
+    fi
+
+    yarn --offline "$yarnBuildScript" $yarnBuildFlags
+
+    echo "finished yarnBuildHook"
+    runHook postBuild
+}
+
+if [[ -z "${dontYarnBuild-}" && -z "${buildPhase-}" ]]; then
+    buildPhase=yarnBuildHook
+fi

pkgs/build-support/node/fetch-yarn-deps/yarn-config-hook.sh

@@ -0,0 +1,74 @@
+yarnConfigHook() {
+    echo "Executing yarnConfigHook"
+
+    # Use a constant HOME directory
+    export HOME=$(mktemp -d)
+    if [[ -n "$yarnOfflineCache" ]]; then
+        offlineCache="$yarnOfflineCache"
+    fi
+    if [[ -z "$offlineCache" ]]; then
+        echo yarnConfigHook: No yarnOfflineCache or offlineCache were defined\! >&2
+        exit 2
+    fi
+
+    local -r cacheLockfile="$offlineCache/yarn.lock"
+    local -r srcLockfile="$PWD/yarn.lock"
+
+    echo "Validating consistency between $srcLockfile and $cacheLockfile"
+
+    if ! @diff@ "$srcLockfile" "$cacheLockfile"; then
+      # If the diff failed, first double-check that the file exists, so we can
+      # give a friendlier error msg.
+      if ! [ -e "$srcLockfile" ]; then
+        echo
+        echo "ERROR: Missing yarn.lock from src. Expected to find it at: $srcLockfile"
+        echo "Hint: You can copy a vendored yarn.lock file via postPatch."
+        echo
+
+        exit 1
+      fi
+
+      if ! [ -e "$cacheLockfile" ]; then
+        echo
+        echo "ERROR: Missing lockfile from cache. Expected to find it at: $cacheLockfile"
+        echo
+
+        exit 1
+      fi
+
+      echo
+      echo "ERROR: fetchYarnDeps hash is out of date"
+      echo
+      echo "The yarn.lock in src is not the same as the in $offlineCache."
+      echo
+      echo "To fix the issue:"
+      echo '1. Use `lib.fakeHash` as the fetchYarnDeps hash value'
+      echo "2. Build the derivation and wait for it to fail with a hash mismatch"
+      echo "3. Copy the 'got: sha256-' value back into the fetchYarnDeps hash field"
+      echo
+
+      exit 1
+    fi
+
+    yarn config --offline set yarn-offline-mirror "$offlineCache"
+    fixup-yarn-lock yarn.lock
+    yarn install \
+        --frozen-lockfile \
+        --force \
+        --production=false \
+        --ignore-engines \
+        --ignore-platform \
+        --ignore-scripts \
+        --no-progress \
+        --non-interactive \
+        --offline
+
+    # TODO: Check if this is really needed
+    patchShebangs node_modules
+
+    echo "finished yarnConfigHook"
+}
+
+if [[ -z "${dontYarnInstallDeps-}" ]]; then
+    postConfigureHooks+=(yarnConfigHook)
+fi

pkgs/build-support/node/fetch-yarn-deps/yarn-install-hook.sh

@@ -0,0 +1,79 @@
+# shellcheck shell=bash
+
+yarnInstallHook() {
+    echo "Executing yarnInstallHook"
+
+    runHook preInstall
+
+    local -r packageOut="$out/lib/node_modules/$(@jq@ --raw-output '.name' ./package.json)"
+    mkdir -p "$packageOut"
+
+    local -ar yarnArgs=(
+        --ignore-engines
+        --ignore-platform
+        --ignore-scripts
+        --no-progress
+        --non-interactive
+        --offline
+    )
+
+    local -r tmpDir="$(mktemp -d)"
+
+    # yarn pack does not work at all with bundleDependencies.
+    # Since we are imediately unpacking, we can just remove them from package.json
+    # This will NOT be fixed in yarn v1: https://github.com/yarnpkg/yarn/issues/6794
+    mv ./package.json "$tmpDir/package.json.orig"
+    # Note: two spellings are accepted, 'bundleDependencies' and 'bundledDependencies'
+    @jq@ 'del(.bundleDependencies)|del(.bundledDependencies)' "$tmpDir/package.json.orig" > ./package.json
+
+    # TODO: figure out a way to avoid redundant compress/decompress steps
+    yarn pack \
+        --filename "$tmpDir/yarn-pack.tgz" \
+        "${yarnArgs[@]}"
+
+    tar xzf "$tmpDir/yarn-pack.tgz" \
+        -C "$packageOut" \
+        --strip-components 1 \
+        package/
+
+    mv "$tmpDir/package.json.orig" ./package.json
+
+    nodejsInstallExecutables ./package.json
+
+    nodejsInstallManuals ./package.json
+
+    local -r nodeModulesPath="$packageOut/node_modules"
+
+    if [ ! -d "$nodeModulesPath" ]; then
+        if [ -z "${yarnKeepDevDeps-}" ]; then
+            # Yarn has a 'prune' command, but it's only a stub that directs you to use install
+            if ! yarn install \
+                --frozen-lockfile \
+                --force \
+                --production=true \
+                "${yarnArgs[@]}"
+            then
+              echo
+              echo
+              echo "ERROR: yarn prune step failed"
+              echo
+              echo 'If yarn tried to download additional dependencies above, try setting `yarnKeepDevDeps = true`.'
+              echo
+
+              exit 1
+            fi
+        fi
+
+        find node_modules -maxdepth 1 -type d -empty -delete
+
+        cp -r node_modules "$nodeModulesPath"
+    fi
+
+    runHook postInstall
+
+    echo "Finished yarnInstallHook"
+}
+
+if [ -z "${dontYarnInstall-}" ] && [ -z "${installPhase-}" ]; then
+    installPhase=yarnInstallHook
+fi