Create a file-system for LUKS-encrypted Btrfs with automatic dependencies.

DEVICE: mapped device target (e.g., "root") MOUNT-POINT: where to mount FLAGS: mount flags (default: '()) OPTIONS: mount options string, overrides SUBVOL and COMPRESS (default: #f) SUBVOL: btrfs subvolume name (default: #f) COMPRESS: #f (no), #t (zstd), "algo", or '(value force) (default: #f) MAPPED-DEVICES: list of mapped-device records for dependencies (default: '())

Return a fixed-output derivation producing SOURCE with a populated vendor/ directory, created by running go mod vendor with network access. HASH is the expected sha256 (nar serializer, nix-base32 string) of the result. GO is the Go toolchain package to use.

Because the result is hash-pinned the build runs as a fixed-output derivation, which guix-daemon grants network access; the builder is given git (for VCS-based module fetches) and TLS root certificates.

Return a fixed-output derivation containing a normalized node_modules tree produced by npm ci for SOURCE's SUBDIRECTORY (which must contain package.json and package-lock.json). HASH is the expected sha256 (nar serializer, nix-base32 string) of the result. NODE is the Node.js package providing npm.

Unlike npm's own cacache store (whose index embeds timestamps and is therefore not bit-reproducible), the installed node_modules tree is deterministic once its file mtimes are flattened and npm's bookkeeping files are stripped. We install with npm ci and then normalize the tree so the resulting FOD hash is stable across CI runs.

Because the result is hash-pinned the build runs as a fixed-output derivation, which guix-daemon grants network access; TLS root certificates are supplied so npm can reach the registry.