Perhaps the easy way to update already exists - just that barely anyone uses it (properly). The feature is submodules - they provide exactly what we need for Ni

Perhaps the easy way to update already exists - just that barely anyone uses it (properly). The feature is submodules - they provide exactly what we need for Nix - they give each commit a list of exact identities to commits in specific branches of submodules (ie, exact dependencies). If we imagine a scenario where our bootstrap package already contains a .nixpkg in its root directory, and we augmented git with a pre-commit hook which mechanically extracted nixpkgs from all submodules, and we introduced a chain of git repositories where submodules are ubiquitously used for our entire system, maybe we could automatically produce the required .nixpkg for each commit (might require us to insert a "package template" into the root of each repository).