Files
mcp-servers/packages/romm-mcp/package.nix
T
hermes-agent b55c7af097
NixOS Configuration CI / Nix Flake Check (pull_request) Successful in 25s
romm-mcp: pin the real source and npmDeps hashes
Both come from the build, and both were non-obvious:

- fetchzip hashes the *unpacked* tree, not the .tgz bytes, so a hash computed
  from the published tarball does not match; the derivation reports the NAR hash
  of the extracted contents instead.
- npmDepsHash only exists once npm has materialised the dependency tree from the
  committed lockfile.

Verified with nix build .#romm-mcp: the derivation builds and ./result/bin/romm-mcp
starts and prints 'RomM MCP server running on stdio'.
2026-11-02 10:13:46 +01:00

39 lines
1.2 KiB
Nix

{
lib,
buildNpmPackage,
fetchzip,
}:
buildNpmPackage rec {
pname = "romm-mcp";
version = "1.0.5";
src = fetchzip {
url = "https://registry.npmjs.org/${pname}/-/${pname}-${version}.tgz";
hash = "sha256-SOYzG0CtNSvIrxOYJq3UDXRlXylqbDjo2f5qfpbiYmI=";
};
# Upstream publishes no package-lock.json (only package.json), and
# buildNpmPackage requires one to compute npmDepsHash. This lock is generated
# from the published tarball itself -- `npm install --package-lock-only
# --ignore-scripts` inside the extracted 1.0.5 package -- so it locks exactly
# the dependency tree that shipped with this version.
npmDepsHash = "sha256-oSlECdIf2ZP8ZZhOUChkcJAmUTj6TFTdeTJLY5RwLGo=";
postPatch = ''
cp ${./package-lock.json} package-lock.json
'';
# dist/*.js (tsc output) ships inside the npm tarball, so there is nothing to
# compile here -- same arrangement as navidrome-mcp and n8n-mcp.
dontNpmBuild = true;
meta = with lib; {
description = "MCP server for RomM: browse, search and administrate a self-hosted ROM library";
homepage = "https://github.com/rodrigosiviero/romm-mcp";
license = licenses.mit;
mainProgram = pname;
platforms = platforms.all;
};
}