I don't think you can get away from explicit package mirroring without compromising having a nixpkgs pinned to a rev. Luckily it's pretty automatable and painl

I don't think you can get away from explicit package mirroring without compromising having a nixpkgs pinned to a rev. Luckily it's pretty automatable and painless if your language has a decent packaging syste - the way Hackage is mirrored is very nice and automated. And then you can just ask for "vector version X.Y.Z" and if that version is there (probably is if nixpkgs is recent and the library is on Hackage), it finds it. And if you don't want to wait for nixpkgs to maintain the Hackage hashes, you can pretty easily maintain it yourself.