buildNimPackage: load lockfiles and overrides

10 files changed, 361 insertions, 111 deletions

diff --git a/doc/languages-frameworks/nim.section.md b/doc/languages-frameworks/nim.section.md
index 6b0fb3df03115..45cd07b3a3d85 100644
--- a/doc/languages-frameworks/nim.section.md
+++ b/doc/languages-frameworks/nim.section.md
@@ -1,74 +1,38 @@
 # Nim {#nim}
 
-## Overview {#nim-overview}
-
-The Nim compiler, a builder function, and some packaged libraries are available
-in Nixpkgs. Until now each compiler release has been effectively backwards
-compatible so only the latest version is available.
-
-## Nim program packages in Nixpkgs {#nim-program-packages-in-nixpkgs}
-
-Nim programs can be built using `nimPackages.buildNimPackage`. In the
-case of packages not containing exported library code the attribute
-`nimBinOnly` should be set to `true`.
+The Nim compiler and a builder function is available.
+Nim programs are built using `buildNimPackage` and a lockfile containing Nim dependencies.
 
 The following example shows a Nim program that depends only on Nim libraries:
-
 ```nix
-{ lib, nimPackages, fetchFromGitHub }:
+{ lib, buildNimPackage, fetchFromGitHub }:
 
-nimPackages.buildNimPackage (finalAttrs: {
+buildNimPackage { } (finalAttrs: {
   pname = "ttop";
-  version = "1.0.1";
-  nimBinOnly = true;
+  version = "1.2.7";
 
   src = fetchFromGitHub {
     owner = "inv2004";
     repo = "ttop";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-x4Uczksh6p3XX/IMrOFtBxIleVHdAPX9e8n32VAUTC4=";
+    hash = "sha256-oPdaUqh6eN1X5kAYVvevOndkB/xnQng9QVLX9bu5P5E=";
   };
 
-  buildInputs = with nimPackages; [ asciigraph illwill parsetoml zippy ];
+  lockFile = ./lock.json;
 
-})
-```
-
-## Nim library packages in Nixpkgs {#nim-library-packages-in-nixpkgs}
-
-
-Nim libraries can also be built using `nimPackages.buildNimPackage`, but
-often the product of a fetcher is sufficient to satisfy a dependency.
-The `fetchgit`, `fetchFromGitHub`, and `fetchNimble` functions yield an
-output that can be discovered during the `configurePhase` of `buildNimPackage`.
-
-Nim library packages are listed in
-[pkgs/top-level/nim-packages.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/top-level/nim-packages.nix) and implemented at
-[pkgs/development/nim-packages](https://github.com/NixOS/nixpkgs/tree/master/pkgs/development/nim-packages).
-
-The following example shows a Nim library that propagates a dependency on a
-non-Nim package:
-```nix
-{ lib, buildNimPackage, fetchNimble, SDL2 }:
-
-buildNimPackage (finalAttrs: {
-  pname = "sdl2";
-  version = "2.0.4";
-  src = fetchNimble {
-    inherit (finalAttrs) pname version;
-    hash = "sha256-Vtcj8goI4zZPQs2TbFoBFlcR5UqDtOldaXSH/+/xULk=";
-  };
-  propagatedBuildInputs = [ SDL2 ];
+  nimFlags = [
+    "-d:NimblePkgVersion=${finalAttrs.version}"
+  ];
 })
 ```
 
 ## `buildNimPackage` parameters {#buildnimpackage-parameters}
 
-All parameters from `stdenv.mkDerivation` function are still supported. The
-following are specific to `buildNimPackage`:
+The `buildNimPackage` function takes an attrset of parameters that are passed on to `stdenv.mkDerivation`.
 
-* `nimBinOnly ? false`: If `true` then build only the programs listed in
-  the Nimble file in the packages sources.
+The following parameters are specific to `buildNimPackage`:
+
+* `lockFile`: JSON formatted lockfile.
 * `nimbleFile`: Specify the Nimble file location of the package being built
   rather than discover the file at build-time.
 * `nimRelease ? true`: Build the package in *release* mode.
@@ -77,6 +41,72 @@ following are specific to `buildNimPackage`:
   Use this to specify defines with arguments in the form of `-d:${name}=${value}`.
 * `nimDoc` ? false`: Build and install HTML documentation.
 
-* `buildInputs` ? []: The packages listed here will be searched for `*.nimble`
-  files which are used to populate the Nim library path. Otherwise the standard
-  behavior is in effect.
+## Lockfiles {#nim-lockfiles}
+Nim lockfiles are created with the `nim_lk` utility.
+Run `nim_lk` with the source directory as an argument and it will print a lockfile to stdout.
+```sh
+$ cd nixpkgs
+$ nix build -f . ttop.src
+$ nix run -f . nim_lk ./result | jq --sort-keys > pkgs/by-name/tt/ttop/lock.json
+```
+
+## Lockfile dependency overrides {#nimoverrides}
+
+The `buildNimPackage` function matches the libraries specified by `lockFile` to attrset of override functions that are then applied to the package derivation.
+The default overrides are maintained as the top-level `nimOverrides` attrset at `pkgs/top-level/nim-overrides.nix`.
+
+For example, to propagate a dependency on SDL2 for lockfiles that select the Nim `sdl2` library, an overlay is added to the set in the `nim-overrides.nix` file:
+```nix
+{ lib
+/* … */
+, SDL2
+/* … */
+}:
+
+{
+  /* … */
+  sdl2 =
+    lockAttrs:
+    finalAttrs:
+    { buildInputs ? [ ], ... }:
+    {
+      buildInputs = buildInputs ++ [ SDL2 ];
+    };
+  /* … */
+}
+```
+
+The annotations in the `nim-overrides.nix` set are functions that take three arguments and return a new attrset to be overlayed on the package being built.
+- lockAttrs: the attrset for this library from within a lockfile. This can be used to implement library version constraints, such as marking libraries as broken or insecure.
+- finalAttrs: the final attrset passed by `buildNimPackage` to `stdenv.mkDerivation`.
+- prevAttrs: the attrset produced by initial arguments to `buildNimPackage` and any preceding lockfile overlays.
+
+### Overriding an Nim library override {#nimoverrides-overrides}
+
+The `nimOverrides` attrset makes it possible to modify overrides in a few different ways.
+
+Override a package internal to its definition:
+```nix
+{ lib, buildNimPackage, nimOverrides, libressl }:
+
+let
+  buildNimPackage' = buildNimPackage.override {
+    nimOverrides = nimOverrides.override { openssl = libressl; };
+  };
+in buildNimPackage' (finalAttrs: {
+  pname = "foo";
+  # …
+})
+
+```
+
+Override a package externally:
+```nix
+{ pkgs }: {
+  foo = pkgs.foo.override {
+    buildNimPackage = pkgs.buildNimPackage.override {
+      nimOverrides = pkgs.nimOverrides.override { openssl = libressl; };
+    };
+  };
+}
+```
diff --git a/pkgs/by-name/ho/hottext/lock.json b/pkgs/by-name/ho/hottext/lock.json
index 5675adc7ff555..add5bdb395340 100644
--- a/pkgs/by-name/ho/hottext/lock.json
+++ b/pkgs/by-name/ho/hottext/lock.json
@@ -1 +1,136 @@
-{"depends":[{"method":"fetchzip","path":"/nix/store/vx0a8hw7hs5an0dnbrn6l16bd6is7hdr-source","rev":"07f6ba8ab96238e5bd1264cf0cea1d1746abb00c","sha256":"005nrldaasfl09zdsni1vi8s7dk0y85ijv6rm2wpj94435x66s36","url":"https://github.com/treeform/flatty/archive/07f6ba8ab96238e5bd1264cf0cea1d1746abb00c.tar.gz","ref":"0.3.4","packages":["flatty"],"srcDir":"src"},{"method":"fetchzip","path":"/nix/store/lk4hcmvwvliliyyidx7k3fk9yfijddc5-source","rev":"b2e71179174e040884ebf6a16cbac711c84620b9","sha256":"0pi6cq43ysm1wy5vva3i2dqvyh4dqppjjjl04yj9wfq7mngpqaa1","url":"https://github.com/treeform/chroma/archive/b2e71179174e040884ebf6a16cbac711c84620b9.tar.gz","ref":"0.2.7","packages":["chroma"],"srcDir":"src"},{"method":"fetchzip","path":"/nix/store/bah1zq369ikykm6dz3r0hzhcq4s88sxq-source","rev":"a2a5165c36e0098dea526712890fb7e988ba27f2","sha256":"0n42hlvh0d9wkjr01p04jnkyn7y4y62pwjdcqw52absapbpsr1lb","url":"https://github.com/treeform/typography/archive/a2a5165c36e0098dea526712890fb7e988ba27f2.tar.gz","ref":"0.7.14","packages":["typography"],"srcDir":"src"},{"method":"fetchzip","path":"/nix/store/9hfg3703m28w76ics7rn0hw1qymz0jrh-source","rev":"156e424306756a106442aca985eed61a8d12097b","sha256":"0hg9iq509rjsgd33cp3452v7whgbc30b5lnajifkls0z66rc2ndh","url":"https://github.com/guzba/nimsimd/archive/156e424306756a106442aca985eed61a8d12097b.tar.gz","ref":"1.2.6","packages":["nimsimd"],"srcDir":"src"},{"method":"fetchzip","path":"/nix/store/xjk8cg4dmja48rcswy0nphy3xhmf7nsz-source","rev":"f3e73f722fbb0e5d496fbc59ee860a9fd49983de","sha256":"12mqlczckhxcrg6il213fn7mcnqz3khwkh7i4bn57l55nzrhfvrh","url":"https://github.com/treeform/pixie/archive/f3e73f722fbb0e5d496fbc59ee860a9fd49983de.tar.gz","ref":"5.0.6","packages":["pixie"],"srcDir":"src"},{"method":"fetchzip","path":"/nix/store/f9dp6njaay5rf32f6l9gkw0dm25gim47-source","rev":"7282ae1247f2f384ebeaec3826d7fa38fd0e1df1","sha256":"1plw9lfrm42qar01rnjhm0d9mkzsc7c3b8kz43w5pb8j8drx1lyn","url":"https://github.com/treeform/vmath/archive/7282ae1247f2f384ebeaec3826d7fa38fd0e1df1.tar.gz","ref":"2.0.0","packages":["vmath"],"srcDir":"src"},{"method":"fetchzip","path":"/nix/store/16h19n8ndv42v8gn2vfdisdszv2wrln1-source","rev":"fb09637d6ebd6416b322a2b9bb95dd513040dea7","sha256":"1lyfnirwpy12lq9gr0sbnkf7ih7ayfvb1acjxk2z5gzlgxm1azp1","url":"https://github.com/treeform/print/archive/fb09637d6ebd6416b322a2b9bb95dd513040dea7.tar.gz","ref":"1.0.2","packages":["print"],"srcDir":"src"},{"method":"fetchzip","path":"/nix/store/zrm3y895iwn057y5c4374bviih962w0v-source","rev":"d0c9ad33ae72aece49093d7688fc78a7101aa4b0","sha256":"14qgxcnyznjc180kdbilqzzya589rqaznfpp75yp37n47zdknfw0","url":"https://github.com/guzba/crunchy/archive/d0c9ad33ae72aece49093d7688fc78a7101aa4b0.tar.gz","ref":"0.1.9","packages":["crunchy"],"srcDir":"src"},{"method":"fetchzip","path":"/nix/store/da49jl6rhz6jlix6mds0alhlbq1qlkfy-source","rev":"84d4702e838d684b7304882ffe796f57ef422fb6","sha256":"1vilid9xx5mp2yvssa3wf6g9svqdan87090klis891k9w1dd8i51","url":"https://github.com/nim-lang/sdl2/archive/84d4702e838d684b7304882ffe796f57ef422fb6.tar.gz","ref":"v2.0.5","packages":["sdl2"],"srcDir":"src"},{"method":"fetchzip","path":"/nix/store/rpa0bv740i3yagp0ldkb68jp6scw4i5l-source","rev":"d7eaf00c24820ad0317c9926737402e62431e931","sha256":"0wrvdpvbwv4ysjsqc6hhvd97vql4k0m5l0zdrsrjlljd1n5g2haq","url":"https://github.com/treeform/bumpy/archive/d7eaf00c24820ad0317c9926737402e62431e931.tar.gz","ref":"1.1.2","packages":["bumpy"],"srcDir":"src"},{"method":"fetchzip","path":"/nix/store/b98qlpki45417ws4pmjq052q1s7333wc-source","rev":"a3fd6f0458ffdd7cbbd416be99f2ca80a7852d82","sha256":"0zmavr2jnyyqkvvi6hlg2kh6qv6lzakwvsqjy0sjm3qdsna0aldg","url":"https://github.com/guzba/zippy/archive/a3fd6f0458ffdd7cbbd416be99f2ca80a7852d82.tar.gz","ref":"0.10.10","packages":["zippy"],"srcDir":"src"}]}
+{
+  "depends": [
+    {
+      "method": "fetchzip",
+      "packages": [
+        "flatty"
+      ],
+      "path": "/nix/store/vx0a8hw7hs5an0dnbrn6l16bd6is7hdr-source",
+      "ref": "0.3.4",
+      "rev": "07f6ba8ab96238e5bd1264cf0cea1d1746abb00c",
+      "sha256": "005nrldaasfl09zdsni1vi8s7dk0y85ijv6rm2wpj94435x66s36",
+      "srcDir": "src",
+      "url": "https://github.com/treeform/flatty/archive/07f6ba8ab96238e5bd1264cf0cea1d1746abb00c.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "chroma"
+      ],
+      "path": "/nix/store/lk4hcmvwvliliyyidx7k3fk9yfijddc5-source",
+      "ref": "0.2.7",
+      "rev": "b2e71179174e040884ebf6a16cbac711c84620b9",
+      "sha256": "0pi6cq43ysm1wy5vva3i2dqvyh4dqppjjjl04yj9wfq7mngpqaa1",
+      "srcDir": "src",
+      "url": "https://github.com/treeform/chroma/archive/b2e71179174e040884ebf6a16cbac711c84620b9.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "typography"
+      ],
+      "path": "/nix/store/bah1zq369ikykm6dz3r0hzhcq4s88sxq-source",
+      "ref": "0.7.14",
+      "rev": "a2a5165c36e0098dea526712890fb7e988ba27f2",
+      "sha256": "0n42hlvh0d9wkjr01p04jnkyn7y4y62pwjdcqw52absapbpsr1lb",
+      "srcDir": "src",
+      "url": "https://github.com/treeform/typography/archive/a2a5165c36e0098dea526712890fb7e988ba27f2.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "nimsimd"
+      ],
+      "path": "/nix/store/9hfg3703m28w76ics7rn0hw1qymz0jrh-source",
+      "ref": "1.2.6",
+      "rev": "156e424306756a106442aca985eed61a8d12097b",
+      "sha256": "0hg9iq509rjsgd33cp3452v7whgbc30b5lnajifkls0z66rc2ndh",
+      "srcDir": "src",
+      "url": "https://github.com/guzba/nimsimd/archive/156e424306756a106442aca985eed61a8d12097b.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "pixie"
+      ],
+      "path": "/nix/store/xjk8cg4dmja48rcswy0nphy3xhmf7nsz-source",
+      "ref": "5.0.6",
+      "rev": "f3e73f722fbb0e5d496fbc59ee860a9fd49983de",
+      "sha256": "12mqlczckhxcrg6il213fn7mcnqz3khwkh7i4bn57l55nzrhfvrh",
+      "srcDir": "src",
+      "url": "https://github.com/treeform/pixie/archive/f3e73f722fbb0e5d496fbc59ee860a9fd49983de.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "vmath"
+      ],
+      "path": "/nix/store/f9dp6njaay5rf32f6l9gkw0dm25gim47-source",
+      "ref": "2.0.0",
+      "rev": "7282ae1247f2f384ebeaec3826d7fa38fd0e1df1",
+      "sha256": "1plw9lfrm42qar01rnjhm0d9mkzsc7c3b8kz43w5pb8j8drx1lyn",
+      "srcDir": "src",
+      "url": "https://github.com/treeform/vmath/archive/7282ae1247f2f384ebeaec3826d7fa38fd0e1df1.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "print"
+      ],
+      "path": "/nix/store/16h19n8ndv42v8gn2vfdisdszv2wrln1-source",
+      "ref": "1.0.2",
+      "rev": "fb09637d6ebd6416b322a2b9bb95dd513040dea7",
+      "sha256": "1lyfnirwpy12lq9gr0sbnkf7ih7ayfvb1acjxk2z5gzlgxm1azp1",
+      "srcDir": "src",
+      "url": "https://github.com/treeform/print/archive/fb09637d6ebd6416b322a2b9bb95dd513040dea7.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "crunchy"
+      ],
+      "path": "/nix/store/zrm3y895iwn057y5c4374bviih962w0v-source",
+      "ref": "0.1.9",
+      "rev": "d0c9ad33ae72aece49093d7688fc78a7101aa4b0",
+      "sha256": "14qgxcnyznjc180kdbilqzzya589rqaznfpp75yp37n47zdknfw0",
+      "srcDir": "src",
+      "url": "https://github.com/guzba/crunchy/archive/d0c9ad33ae72aece49093d7688fc78a7101aa4b0.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "sdl2"
+      ],
+      "path": "/nix/store/da49jl6rhz6jlix6mds0alhlbq1qlkfy-source",
+      "ref": "v2.0.5",
+      "rev": "84d4702e838d684b7304882ffe796f57ef422fb6",
+      "sha256": "1vilid9xx5mp2yvssa3wf6g9svqdan87090klis891k9w1dd8i51",
+      "srcDir": "src",
+      "url": "https://github.com/nim-lang/sdl2/archive/84d4702e838d684b7304882ffe796f57ef422fb6.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "bumpy"
+      ],
+      "path": "/nix/store/rpa0bv740i3yagp0ldkb68jp6scw4i5l-source",
+      "ref": "1.1.2",
+      "rev": "d7eaf00c24820ad0317c9926737402e62431e931",
+      "sha256": "0wrvdpvbwv4ysjsqc6hhvd97vql4k0m5l0zdrsrjlljd1n5g2haq",
+      "srcDir": "src",
+      "url": "https://github.com/treeform/bumpy/archive/d7eaf00c24820ad0317c9926737402e62431e931.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "zippy"
+      ],
+      "path": "/nix/store/b98qlpki45417ws4pmjq052q1s7333wc-source",
+      "ref": "0.10.10",
+      "rev": "a3fd6f0458ffdd7cbbd416be99f2ca80a7852d82",
+      "sha256": "0zmavr2jnyyqkvvi6hlg2kh6qv6lzakwvsqjy0sjm3qdsna0aldg",
+      "srcDir": "src",
+      "url": "https://github.com/guzba/zippy/archive/a3fd6f0458ffdd7cbbd416be99f2ca80a7852d82.tar.gz"
+    }
+  ]
+}
diff --git a/pkgs/by-name/ho/hottext/package.nix b/pkgs/by-name/ho/hottext/package.nix
index e164ff1122f32..021e44f3c093f 100644
--- a/pkgs/by-name/ho/hottext/package.nix
+++ b/pkgs/by-name/ho/hottext/package.nix
@@ -1,11 +1,9 @@
-{ lib, nim2Packages, fetchFromSourcehut, gentium, makeDesktopItem, nim_lk, SDL2 }:
+{ lib, buildNimPackage, fetchFromSourcehut, gentium, makeDesktopItem }:
 
-nim2Packages.buildNimPackage (finalAttrs: {
+buildNimPackage (finalAttrs: {
   pname = "hottext";
   version = "20231003";
 
-  nimBinOnly = true;
-
   src = fetchFromSourcehut {
     owner = "~ehmry";
     repo = "hottext";
@@ -13,9 +11,7 @@ nim2Packages.buildNimPackage (finalAttrs: {
     hash = "sha256-ncH/1PV4vZY7JCUJ87FPz5bdrQsNlYxzGdc5BQNfQeA=";
   };
 
-  buildInputs = [ SDL2 ];
-
-  nimFlags = nim_lk.passthru.nimFlagsFromLockFile ./lock.json;
+  lockFile = ./lock.json;
 
   HOTTEXT_FONT_PATH = "${gentium}/share/fonts/truetype/GentiumPlus-Regular.ttf";
 
diff --git a/pkgs/by-name/ni/nim_builder/nim_builder.nim b/pkgs/by-name/ni/nim_builder/nim_builder.nim
index 8b70aa91ca992..ec1d3ccb45b99 100644
--- a/pkgs/by-name/ni/nim_builder/nim_builder.nim
+++ b/pkgs/by-name/ni/nim_builder/nim_builder.nim
@@ -133,9 +133,9 @@ proc buildPhase*() =
     if err != 0: quit("build phase failed", err)
 
 proc installPhase*() =
-  ## Install the Nim sources if ``nimBinOnly`` is not
+  ## Install the Nim sources if ``nimCopySources`` is
   ## set in the environment.
-  if not getEnvBool"nimBinOnly":
+  if getEnvBool"nimCopySources":
     let
       nf = getNimbleFilePath()
       srcDir = nf.getNimbleValue("srcDir", ".")
diff --git a/pkgs/by-name/ni/nim_lk/lock.json b/pkgs/by-name/ni/nim_lk/lock.json
index 38a4f8c8e3e80..90929f01a04bc 100644
--- a/pkgs/by-name/ni/nim_lk/lock.json
+++ b/pkgs/by-name/ni/nim_lk/lock.json
@@ -1 +1,28 @@
-{"depends":[{"method":"fetchzip","packages":["npeg"],"path":"/nix/store/ffkxmjmigfs7zhhiiqm0iw2c34smyciy-source","ref":"1.2.1","rev":"26d62fdc40feb84c6533956dc11d5ee9ea9b6c09","sha256":"0xpzifjkfp49w76qmaylan8q181bs45anmp46l4bwr3lkrr7bpwh","srcDir":"src","url":"https://github.com/zevv/npeg/archive/26d62fdc40feb84c6533956dc11d5ee9ea9b6c09.tar.gz"},{"method":"fetchzip","packages":["preserves"],"path":"/nix/store/nrcpzf9hx70kry3gwhrdzcs3qicjncjh-source","ref":"20231021","rev":"edece399be70818208bf2263c30cb2bcf435bbff","sha256":"0xmw35wmw3a4lja9q4qvlvpxv3xk0hnkjg4fwfw6f3inh6zfiqki","srcDir":"src","url":"https://git.syndicate-lang.org/ehmry/preserves-nim/archive/edece399be70818208bf2263c30cb2bcf435bbff.tar.gz"}]}
+{
+  "depends": [
+    {
+      "method": "fetchzip",
+      "packages": [
+        "npeg"
+      ],
+      "path": "/nix/store/ffkxmjmigfs7zhhiiqm0iw2c34smyciy-source",
+      "ref": "1.2.1",
+      "rev": "26d62fdc40feb84c6533956dc11d5ee9ea9b6c09",
+      "sha256": "0xpzifjkfp49w76qmaylan8q181bs45anmp46l4bwr3lkrr7bpwh",
+      "srcDir": "src",
+      "url": "https://github.com/zevv/npeg/archive/26d62fdc40feb84c6533956dc11d5ee9ea9b6c09.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "preserves"
+      ],
+      "path": "/nix/store/nrcpzf9hx70kry3gwhrdzcs3qicjncjh-source",
+      "ref": "20231021",
+      "rev": "edece399be70818208bf2263c30cb2bcf435bbff",
+      "sha256": "0xmw35wmw3a4lja9q4qvlvpxv3xk0hnkjg4fwfw6f3inh6zfiqki",
+      "srcDir": "src",
+      "url": "https://git.syndicate-lang.org/ehmry/preserves-nim/archive/edece399be70818208bf2263c30cb2bcf435bbff.tar.gz"
+    }
+  ]
+}
diff --git a/pkgs/by-name/ni/nim_lk/package.nix b/pkgs/by-name/ni/nim_lk/package.nix
index 833860b357fe0..aeac25ac1a9ff 100644
--- a/pkgs/by-name/ni/nim_lk/package.nix
+++ b/pkgs/by-name/ni/nim_lk/package.nix
@@ -1,9 +1,8 @@
-{ lib, buildPackages, nim2Packages, fetchFromSourcehut, openssl }:
+{ lib, buildNimPackage, fetchFromSourcehut, nim, openssl, makeWrapper }:
 
-nim2Packages.buildNimPackage (finalAttrs: {
+buildNimPackage (finalAttrs: {
   pname = "nim_lk";
   version = "20231031";
-  nimBinOnly = true;
 
   src = fetchFromSourcehut {
     owner = "~ehmry";
@@ -13,8 +12,14 @@ nim2Packages.buildNimPackage (finalAttrs: {
   };
 
   buildInputs = [ openssl ];
+  nativeBuildInputs = [ makeWrapper ];
 
-  nimFlags = finalAttrs.passthru.nimFlagsFromLockFile ./lock.json;
+  lockFile = ./lock.json;
+
+  postFixup = ''
+    wrapProgram $out/bin/nim_lk \
+      --suffix PATH : ${lib.makeBinPath [ nim ]}
+  '';
 
   meta = finalAttrs.src.meta // {
     description = "Generate Nix specific lock files for Nim packages";
@@ -24,29 +29,4 @@ nim2Packages.buildNimPackage (finalAttrs: {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ ehmry ];
   };
-
-  passthru.nimFlagsFromLockFile = let
-    fetchDependency = let
-      methods = {
-        fetchzip = { url, sha256, ... }:
-          buildPackages.fetchzip {
-            name = "source";
-            inherit url sha256;
-          };
-        git = { fetchSubmodules, leaveDotGit, rev, sha256, url, ... }:
-          buildPackages.fetchgit {
-            inherit fetchSubmodules leaveDotGit rev sha256 url;
-          };
-      };
-    in attrs@{ method, ... }: methods.${method} attrs // attrs;
-  in lockFile:
-  with builtins;
-  lib.pipe lockFile [
-    readFile
-    fromJSON
-    (getAttr "depends")
-    (map fetchDependency)
-    (map ({ outPath, srcDir, ... }: ''--path:"${outPath}/${srcDir}"''))
-  ];
-
 })
diff --git a/pkgs/development/compilers/nim/build-nim-package.nix b/pkgs/development/compilers/nim/build-nim-package.nix
index d11eb7cd8e302..73190575a5763 100644
--- a/pkgs/development/compilers/nim/build-nim-package.nix
+++ b/pkgs/development/compilers/nim/build-nim-package.nix
@@ -1,5 +1,13 @@
-{ lib, stdenv, nim1, nim2, nim_builder, defaultNimVersion ? 2 }:
-pkgArgs:
+{ lib
+, buildPackages
+, callPackage
+, stdenv
+, nim1
+, nim2
+, nim_builder
+, defaultNimVersion ? 2
+, nimOverrides
+}:
 
 let
   baseAttrs = {
@@ -30,22 +38,79 @@ let
     meta = { inherit (nim2.meta) maintainers platforms; };
   };
 
-  inputsOverride = { depsBuildBuild ? [ ], nativeBuildInputs ? [ ]
-    , requiredNimVersion ? defaultNimVersion, ... }:
-    (if requiredNimVersion == 1 then {
-      nativeBuildInputs = [ nim1 ] ++ nativeBuildInputs;
-    } else if requiredNimVersion == 2 then {
-      nativeBuildInputs = [ nim2 ] ++ nativeBuildInputs;
-    } else
-      throw "requiredNimVersion ${toString requiredNimVersion} is not valid")
-    // {
-      depsBuildBuild = [ nim_builder ] ++ depsBuildBuild;
-    };
+  fodFromLockEntry =
+    let
+      methods = {
+        fetchzip = { url, sha256, ... }:
+          buildPackages.fetchzip {
+            name = "source";
+            inherit url sha256;
+          };
+        git = { fetchSubmodules, leaveDotGit, rev, sha256, url, ... }:
+          buildPackages.fetchgit {
+            inherit fetchSubmodules leaveDotGit rev sha256 url;
+          };
+      };
+    in
+    attrs@{ method, ... }:
+    let fod = methods.${method} attrs;
+    in ''--path:"${fod.outPath}/${attrs.srcDir}"'';
+
+  callAnnotations = { packages, ... }@lockAttrs:
+    map (packageName: nimOverrides.${packageName} or (_: [ ]) lockAttrs)
+      packages;
+
+  asFunc = x: if builtins.isFunction x then x else (_: x);
 
+in
+buildNimPackageArgs:
+let
   composition = finalAttrs:
     let
-      asFunc = x: if builtins.isFunction x then x else (_: x);
-      prev = baseAttrs // (asFunc ((asFunc pkgArgs) finalAttrs)) baseAttrs;
-    in prev // inputsOverride prev;
+      postPkg = baseAttrs
+        // (asFunc ((asFunc buildNimPackageArgs) finalAttrs)) baseAttrs;
+
+      lockAttrs =
+        lib.attrsets.optionalAttrs (builtins.hasAttr "lockFile" postPkg)
+          (builtins.fromJSON (builtins.readFile postPkg.lockFile));
+
+      lockDepends = lockAttrs.depends or [ ];
+
+      lockFileNimFlags = map fodFromLockEntry lockDepends;
+
+      annotationOverlays = lib.lists.flatten (map callAnnotations lockDepends);
+
+      postLock = builtins.foldl'
+        (prevAttrs: overlay: prevAttrs // (overlay finalAttrs prevAttrs))
+        postPkg
+        annotationOverlays;
+
+      finalOverride =
+        { depsBuildBuild ? [ ]
+        , nativeBuildInputs ? [ ]
+        , nimFlags ? [ ]
+        , requiredNimVersion ? defaultNimVersion
+        , nimCopySources ? (lockAttrs == {}) # TODO: remove when nimPackages is gone
+        , ...
+        }:
+        (if requiredNimVersion == 1 then {
+          depsBuildBuild = [ nim_builder ] ++ depsBuildBuild;
+          nativeBuildInputs = [ nim1 ] ++ nativeBuildInputs;
+        } else if requiredNimVersion == 2 then {
+          depsBuildBuild = [ nim_builder ] ++ depsBuildBuild;
+          nativeBuildInputs = [ nim2 ] ++ nativeBuildInputs;
+        } else
+          throw
+            "requiredNimVersion ${toString requiredNimVersion} is not valid") // {
+          nimFlags = lockFileNimFlags ++ nimFlags;
+          inherit nimCopySources;
+        };
+
+      attrs = postLock // finalOverride postLock;
+    in
+    lib.trivial.warnIf (builtins.hasAttr "nimBinOnly" attrs)
+      "the nimBinOnly attribute is deprecated for buildNimPackage"
+      attrs;
 
-in stdenv.mkDerivation composition
+in
+stdenv.mkDerivation composition
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b62acb50ae270..b0ccb0663e65f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16811,6 +16811,7 @@ with pkgs;
   nimPackages = recurseIntoAttrs nim1.pkgs;
   nim2Packages = recurseIntoAttrs nim2.pkgs;
   buildNimPackage = callPackage ../development/compilers/nim/build-nim-package.nix { };
+  nimOverrides = callPackage ./nim-overrides.nix { };
 
   nrpl = callPackage ../development/tools/nrpl { };
 
diff --git a/pkgs/top-level/nim-overrides.nix b/pkgs/top-level/nim-overrides.nix
new file mode 100644
index 0000000000000..cf7a14b18d7d9
--- /dev/null
+++ b/pkgs/top-level/nim-overrides.nix
@@ -0,0 +1,16 @@
+{ lib
+, SDL2
+}:
+
+# The following is list of overrides that take three arguments each:
+# - lockAttrs: - an attrset from a Nim lockfile, use this for making constraints on the locked library
+# - finalAttrs: - final arguments to the depender package
+# - prevAttrs: - preceding arguments to the depender package
+{
+
+  sdl2 = lockAttrs: finalAttrs:
+    { buildInputs ? [ ], ... }: {
+      buildInputs = buildInputs ++ [ SDL2 ];
+    };
+
+}
diff --git a/pkgs/top-level/nim-packages.nix b/pkgs/top-level/nim-packages.nix
index ea3091237c13d..e60c8b416eade 100644
--- a/pkgs/top-level/nim-packages.nix
+++ b/pkgs/top-level/nim-packages.nix
@@ -7,7 +7,7 @@ lib.makeScope newScope (self:
     buildNimPackage = buildNimPackage.override {
       defaultNimVersion =
         if lib.versionAtLeast nim.version "2.0.0" then 2 else 1;
-    };
+    } { };
 
     asciigraph = callPackage ../development/nim-packages/asciigraph { };