`fetchurl` Advanced Attributes: Post-processing, Authentication, and cURL Options

By default, `fetchurl` uses `"recursive"` mode when the `executable` attribute is set to `true`, so you don't need to specify `recursiveHash` in this case. _Default value:_ `false`. `executable` (Boolean; _optional_) : If `true`, sets the executable bit on the downloaded file. _Default value_: `false`. `downloadToTemp` (Boolean; _optional_) []{#sec-pkgs-fetchers-fetchurl-inputs-downloadToTemp} : If `true`, saves the downloaded file to a temporary location instead of the expected Nix store location. This is useful when used in conjunction with `postFetch` attribute, otherwise `fetchurl` will not produce any meaningful output. The location of the downloaded file will be set in the `$downloadedFile` variable, which should be used by the script in the `postFetch` attribute. See [](#ex-fetchers-fetchurl-nixpkgs-version-postfetch) to understand how to work with this attribute. _Default value:_ `false`. `postFetch` (String; _optional_) : Script executed after the file has been downloaded successfully, and before `fetchurl` finishes running. Useful for post-processing, to check or transform the file in some way. See [](#ex-fetchers-fetchurl-nixpkgs-version-postfetch) to understand how to work with this attribute. _Default value:_ `""`. `netrcPhase` (String or Null; _optional_) : Script executed to create a {manpage}`netrc(5)` file to be used with {manpage}`curl(1)`. The script should create the `netrc` file (note that it does not begin with a ".") in the directory it's currently running in (`$PWD`). The script is executed during the setup done by `fetchurl` before it runs any of its code to download the specified content. :::{.note} If specified, `fetchurl` will automatically alter its invocation of {manpage}`curl(1)` to use the `netrc` file, so you don't need to add anything to `curlOpts` or `curlOptsList`. ::: :::{.caution} Since `netrcPhase` needs to be specified in your source Nix code, any secrets that you put directly in it will be world-readable by design (both in your source code, and when the derivation gets created in the Nix store). If you want to avoid this behaviour, see the documentation of `netrcImpureEnvVars` for an alternative way of dealing with these secrets. ::: _Default value_: `null`. `netrcImpureEnvVars` (List of String; _optional_) : If specified, `fetchurl` will add these environment variable names to the list of [impure environment variables](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-impureEnvVars), which will be passed from the environment of the calling user to the builder running the `fetchurl` code. This is useful when used with `netrcPhase` to hide any secrets that are used in it, because the script in `netrcPhase` only needs to reference the environment variables with the secrets in them instead. However, note that these are called _impure_ variables for a reason: the environment that starts the build needs to have these variables declared for everything to work properly, which means that additional setup is required outside what Nix controls. _Default value:_ `[]`. `curlOpts` (String; _optional_) : If specified, this value will be appended to the invocation of {manpage}`curl(1)` when downloading the URL(s) given to `fetchurl`. Multiple arguments can be separated by spaces normally, but values with whitespaces will be interpreted as multiple arguments (instead of a single value), even if the value is escaped. See `curlOptsList` for a way to pass values with whitespaces in them. _Default value:_ `""`. `curlOptsList` (List of String; _optional_) : If specified, each element of this list will be passed as an argument to the invocation of {manpage}`curl(1)` when downloading the URL(s) given to `fetchurl`. This allows passing values that contain spaces, with no escaping needed. _Default value:_ `[]`. `showURLs` (Boolean; _optional_) : If set to `true`, this will stop `fetchurl` from downloading anything at all.

This chunk describes `fetchurl` attributes for download behavior, post-processing, and authentication. `recursiveHash` defaults to `true` if `executable` is set; `executable` makes the downloaded file executable. `downloadToTemp` saves files to a temporary location, useful with `postFetch` (a script run after download for post-processing, exposing the file path via `$downloadedFile`). For authentication, `netrcPhase` scripts create a `netrc` file for `curl`, but direct secrets are world-readable. `netrcImpureEnvVars` is a more secure alternative, passing secret environment variable names as impure variables, requiring external setup. Custom `curl` options use `curlOpts` (string, space-separated) or `curlOptsList` (list of strings, for values with spaces). `showURLs` prevents any download if set to `true`.