bulk versions.json

docs/version.schema.json

@@ -0,0 +1,208 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://example.invalid/version.schema.json",
+  "title": "Unified Package Version Schema",
+  "description": "Schema for a unified version.json used by packages/",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "sources"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "type": "integer",
+      "enum": [1],
+      "description": "Schema version. Start at 1; bump on breaking changes."
+    },
+    "variables": {
+      "type": "object",
+      "description": "Common variables available for template substitution in string fields.",
+      "additionalProperties": {
+        "type": "string"
+      }
+    },
+    "defaultVariant": {
+      "type": "string",
+      "description": "Optional default variant name for consumers."
+    },
+    "sources": {
+      "type": "object",
+      "description": "Base component sources keyed by component name.",
+      "minProperties": 1,
+      "additionalProperties": {
+        "$ref": "#/$defs/SourceSpec"
+      }
+    },
+    "variants": {
+      "type": "object",
+      "description": "Optional variants/channels/flavors; each overlays the base.",
+      "additionalProperties": {
+        "$ref": "#/$defs/VariantSpec"
+      }
+    },
+    "notes": {
+      "type": "object",
+      "description": "Optional free-form human notes/documentation.",
+      "additionalProperties": true
+    }
+  },
+  "$defs": {
+    "SourceSpecBase": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "fetcher": {
+          "type": "string",
+          "enum": ["github", "git", "url", "pypi", "none"],
+          "description": "Fetcher type for this source."
+        },
+        "hash": {
+          "type": "string",
+          "pattern": "^sha[0-9]+-",
+          "description": "SRI hash for the fetched artifact. Required unless fetcher is 'none'."
+        },
+        "version": {
+          "type": "string",
+          "description": "Optional version string metadata for this component."
+        },
+        "extra": {
+          "type": "object",
+          "description": "Optional free-form metadata for consumer logic.",
+          "additionalProperties": true
+        },
+
+        "owner": { "type": "string", "description": "GitHub owner/org (github fetcher)." },
+        "repo":  { "type": "string", "description": "GitHub repository (github fetcher)." },
+        "tag":   { "type": "string", "description": "Git tag (github fetcher). Mutually exclusive with 'rev'." },
+        "rev":   { "type": "string", "description": "Commit revision (github/git fetchers)." },
+        "submodules": { "type": "boolean", "description": "Whether to fetch submodules (github/git fetchers)." },
+
+        "url": { "type": "string", "description": "Final URL (url fetcher). May be templated." },
+        "urlTemplate": { "type": "string", "description": "Template for URL (url fetcher); supports ${var}." },
+
+        "name": { "type": "string", "description": "PyPI dist name (pypi fetcher)." }
+      }
+    },
+
+    "SourceSpec": {
+      "allOf": [
+        { "$ref": "#/$defs/SourceSpecBase" },
+        {
+          "if": {
+            "properties": { "fetcher": { "const": "github" } },
+            "required": ["fetcher"]
+          },
+          "then": {
+            "required": ["owner", "repo"],
+            "oneOf": [
+              { "required": ["tag"] },
+              { "required": ["rev"] }
+            ]
+          }
+        },
+        {
+          "if": {
+            "properties": { "fetcher": { "const": "git" } },
+            "required": ["fetcher"]
+          },
+          "then": {
+            "required": ["url", "rev"]
+          }
+        },
+        {
+          "if": {
+            "properties": { "fetcher": { "const": "url" } },
+            "required": ["fetcher"]
+          },
+          "then": {
+            "oneOf": [
+              { "required": ["url"] },
+              { "required": ["urlTemplate"] }
+            ]
+          }
+        },
+        {
+          "if": {
+            "properties": { "fetcher": { "const": "pypi" } },
+            "required": ["fetcher"]
+          },
+          "then": {
+            "required": ["name", "version"]
+          }
+        },
+        {
+          "if": {
+            "properties": { "fetcher": { "enum": ["github", "git", "url", "pypi"] } },
+            "required": ["fetcher"]
+          },
+          "then": {
+            "required": ["hash"]
+          }
+        }
+      ]
+    },
+
+    "SourceOverride": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Partial override of a source within a variant. All fields optional.",
+      "properties": {
+        "fetcher": { "type": "string", "enum": ["github", "git", "url", "pypi", "none"] },
+        "hash":    { "type": "string", "pattern": "^sha[0-9]+-" },
+        "version": { "type": "string" },
+        "extra":   { "type": "object", "additionalProperties": true },
+
+        "owner": { "type": "string" },
+        "repo":  { "type": "string" },
+        "tag":   { "type": "string" },
+        "rev":   { "type": "string" },
+        "submodules": { "type": "boolean" },
+
+        "url":         { "type": "string" },
+        "urlTemplate": { "type": "string" },
+
+        "name": { "type": "string" }
+      }
+    },
+
+    "VariantSpec": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "inherits": {
+          "type": "string",
+          "description": "Optional base variant to inherit from."
+        },
+        "variables": {
+          "type": "object",
+          "description": "Variant-level variables that overlay top-level variables.",
+          "additionalProperties": { "type": "string" }
+        },
+        "sources": {
+          "type": "object",
+          "description": "Per-component overrides for this variant.",
+          "additionalProperties": { "$ref": "#/$defs/SourceOverride" }
+        },
+        "platforms": {
+          "type": "object",
+          "description": "Optional per-system overrides to support differing hashes/fields by platform.",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "sources": {
+                "type": "object",
+                "additionalProperties": { "$ref": "#/$defs/SourceOverride" }
+              },
+              "variables": {
+                "type": "object",
+                "additionalProperties": { "type": "string" }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

lib/versioning.nix

@@ -0,0 +1,181 @@
+{ lib, pkgs }:
+
+let
+  inherit (builtins)
+    isAttrs
+    isList
+    isString
+    hasAttr
+    getAttr
+    attrNames
+    toString
+    replaceStrings;
+
+  mapAttrs = lib.mapAttrs;
+  recursiveUpdate = lib.recursiveUpdate;
+
+  # Deep-merge attrsets (right-biased).
+  deepMerge = a: b: recursiveUpdate a b;
+
+  # Merge component sources: base.sources overlaid by overrides (component-wise deep merge).
+  mergeSources = baseSources: overrides:
+    baseSources //
+    mapAttrs (name: ov:
+      if hasAttr name baseSources then deepMerge (getAttr name baseSources) ov else ov
+    ) overrides;
+
+  # Apply a single variant overlay (variables + sources).
+  applyVariantOnce = selected: variant:
+    let
+      vVars = if variant ? variables then variant.variables else {};
+      vSrcs = if variant ? sources then variant.sources else {};
+    in
+    {
+      variables = selected.variables // vVars;
+      sources   = mergeSources selected.sources vSrcs;
+    };
+
+  # Apply platform-specific overrides if present for the given system.
+  applyPlatforms = selected: variant: system:
+    if system == null || !(variant ? platforms) || !(hasAttr system variant.platforms) then
+      selected
+    else
+      let
+        p = variant.platforms.${system};
+        pVars = if p ? variables then p.variables else {};
+        pSrcs = if p ? sources then p.sources else {};
+      in
+      {
+        variables = selected.variables // pVars;
+        sources   = mergeSources selected.sources pSrcs;
+      };
+
+  # Resolve variant chain via inherits (ancestor first), then apply platforms.
+  resolveVariant = spec: baseSelected: variantName: system:
+    if variantName == null || !(spec ? variants) || !(hasAttr variantName spec.variants) then
+      baseSelected
+    else
+      let
+        v = spec.variants.${variantName};
+        parentSelected =
+          if v ? inherits then resolveVariant spec baseSelected v.inherits system else baseSelected;
+        withVariant = applyVariantOnce parentSelected v;
+      in
+      applyPlatforms withVariant v system;
+
+  # Render ${var} substitutions in any string within attrs/lists.
+  renderValue = value: vars:
+    if isString value then
+      let
+        keys = attrNames vars;
+        patterns = map (k: "\${" + k + "}") keys;
+        replacements = map (k: toString (getAttr k vars)) keys;
+      in
+      replaceStrings patterns replacements value
+    else if isAttrs value then
+      mapAttrs (_: v: renderValue v vars) value
+    else if isList value then
+      map (v: renderValue v vars) value
+    else
+      value;
+
+  # Decide fetcher for URL type based on optional extra.unpack hint.
+  useFetchZip = comp:
+    comp ? extra && comp.extra ? unpack && comp.extra.unpack == "zip";
+
+  # Build a single src from a rendered component spec.
+  mkSrcFromRendered = comp:
+    let
+      fetcher = if comp ? fetcher then comp.fetcher else "none";
+    in
+    if fetcher == "github" then
+      pkgs.fetchFromGitHub ({
+        owner = comp.owner;
+        repo  = comp.repo;
+        # Allow tag as rev (ignore null/empty tag)
+        rev   = if comp ? tag && comp.tag != null && comp.tag != "" then comp.tag else comp.rev;
+        fetchSubmodules = if comp ? submodules then comp.submodules else false;
+        hash = comp.hash;
+      } // lib.optionalAttrs (comp ? name) { name = comp.name; })
+    else if fetcher == "git" then
+      pkgs.fetchgit {
+        url = comp.url;
+        rev = comp.rev;
+        fetchSubmodules = if comp ? submodules then comp.submodules else false;
+        hash = comp.hash;
+      }
+    else if fetcher == "url" then
+      let
+        url = if comp ? url then comp.url else comp.urlTemplate;
+      in
+      if useFetchZip comp then
+        pkgs.fetchzip (
+          { inherit url; hash = comp.hash; }
+          // lib.optionalAttrs (comp ? extra && comp.extra ? stripRoot) { stripRoot = comp.extra.stripRoot; }
+        )
+      else
+        pkgs.fetchurl { inherit url; hash = comp.hash; }
+    else if fetcher == "pypi" then
+      pkgs.python3Packages.fetchPypi {
+        pname = comp.name;
+        version = comp.version;
+        hash = comp.hash;
+      }
+    else
+      # fetcher == "none": pass-through (e.g., linux version/hash consumed by custom logic)
+      comp;
+
+in rec {
+  /*
+    Select a variant from a loaded version.json specification.
+
+    Usage:
+      let selected = versioning.selectVariant spec variantName system;
+      - spec: attrset from lib.importJSON ./version.json
+      - variantName: string or null (when null, uses spec.defaultVariant if present)
+      - system: string like "x86_64-linux" or null (to apply platforms overrides)
+  */
+  selectVariant = spec: variantName: system:
+    let
+      chosen = if variantName != null then variantName else (if spec ? defaultVariant then spec.defaultVariant else null);
+      baseSelected = {
+        variables = if spec ? variables then spec.variables else {};
+        sources   = if spec ? sources then spec.sources else {};
+      };
+    in
+    resolveVariant spec baseSelected chosen system;
+
+  /*
+    Render ${var} template substitutions across any value using provided variables.
+    Strings, attrsets, and lists are traversed.
+  */
+  render = value: variables: renderValue value variables;
+
+  /*
+    Render a component with variables and then build its src (or pass-through for fetcher "none").
+    Prefer using mkAllSources, which handles rendering for all components.
+  */
+  mkSrc = comp: variables:
+    let rendered = renderValue comp variables;
+    in mkSrcFromRendered rendered;
+
+  /*
+    Produce an attrset of all sources for a selected spec:
+      mkAllSources selected
+    Where:
+      selected = selectVariant spec variantName system
+    Returns:
+      { componentName = src | renderedComp (for "none"); ... }
+  */
+  mkAllSources = selected:
+    mapAttrs (_name: comp:
+      if comp ? fetcher && comp.fetcher == "none"
+      then renderValue comp selected.variables
+      else mkSrc (renderValue comp selected.variables) selected.variables
+    ) selected.sources;
+
+  /*
+    Expose deepMerge for convenience (right-biased).
+  */
+  inherit deepMerge;
+}

packages/arm-trusted-firmware/default.nix

@@ -2,24 +2,24 @@
   stdenv,
   fetchFromGitHub,
   lib,
+  pkgs,
   MODEL ? "5",
   DEBUG ? "0",
   TFA_FLAGS ? "",
 }:
 let
   inherit (lib.trivial) importJSON;
-  versions = importJSON ./versions.json;
+  versionSpec = importJSON ./version.json;
+  versioning = import ../../lib/versioning.nix { inherit lib pkgs; };
+  selected = versioning.selectVariant versionSpec null null;
+  sources = versioning.mkAllSources selected;
+  fw = selected.sources.fw;
 in
 stdenv.mkDerivation rec {
   pname = "arm-trusted-firmware";
-  version = versions.fw.rev;
+  version = if fw ? tag then fw.tag else fw.rev;
 
-  src = fetchFromGitHub {
+  src = sources.fw;
-    owner = "ARM-software";
-    repo = "arm-trusted-firmware";
-    rev = "${version}";
-    hash = versions.fw.hash;
-  };
 
   # Add required host tools if needed:
   nativeBuildInputs = [

packages/arm-trusted-firmware/version.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": 1,
+  "sources": {
+    "fw": {
+      "fetcher": "github",
+      "owner": "ARM-software",
+      "repo": "arm-trusted-firmware",
+      "rev": "8fd4c786594239de20669f062e416fe1a37ca59e",
+      "hash": "sha256-eh0b4q6od9ZWAFBQ+wRjpLQEEf8kox2L3l1iHwQtju8="
+    }
+  }
+}

packages/arm-trusted-firmware/versions.json

@@ -1,9 +0,0 @@
-{
-  "fw": {
-    "hash": "sha256-eh0b4q6od9ZWAFBQ+wRjpLQEEf8kox2L3l1iHwQtju8=",
-    "location": "github",
-    "owner": "ARM-software",
-    "repo": "arm-trusted-firmware",
-    "rev": "8fd4c786594239de20669f062e416fe1a37ca59e"
-  }
-}

packages/edk2/default.nix

@@ -21,35 +21,16 @@ let
 
   pname = "edk2";
   version = "stable202511";
-  versions = importJSON ./versions.json;
+  versionSpec = importJSON ./version.json;
+  versioning = import ../../lib/versioning.nix { inherit lib pkgs; };
+  selected = versioning.selectVariant versionSpec (if MODEL == "5" then "mjallen" else null) null;
+  sources = versioning.mkAllSources selected;
 
-  repoOwner = (if MODEL == "5" then "-mjallen" else "");
+  edk2Src = sources.edk2;
 
-  edk2Src =  fetchFromGitHub rec {
+  edk2NonOsiSrc = sources."edk2-non-osi";
-    owner = versions."edk2${repoOwner}".owner;
-    repo = "edk2";
-    name = repo;
-    rev = (if MODEL == "5" then versions."edk2${repoOwner}".rev else null);
-    tag = (if MODEL == "5" then null else versions."edk2${repoOwner}".tag);
-    hash = versions."edk2${repoOwner}".hash;
-    fetchSubmodules = true;
-  };
 
-  edk2NonOsiSrc = fetchFromGitHub rec {
+  edk2PlatformsSrc = sources."edk2-platforms";
-    owner = versions."edk2-non-osi${repoOwner}".owner;
-    repo = "edk2-non-osi";
-    name = repo;
-    rev = versions."edk2-non-osi${repoOwner}".rev;
-    hash = versions."edk2-non-osi${repoOwner}".hash;
-  };
-
-  edk2PlatformsSrc = fetchFromGitHub rec {
-    owner = versions."edk2-platforms${repoOwner}".owner;
-    repo = "edk2-platforms";
-    name = repo;
-    rev = versions."edk2-platforms${repoOwner}".rev;
-    hash = versions."edk2-platforms${repoOwner}".hash;
-  };
 
   baseTools = pkgs.${namespace}.edk2-basetools.override {
     version = "stable202511";

packages/edk2/version.json

@@ -0,0 +1,53 @@
+{
+  "schemaVersion": 1,
+  "sources": {
+    "edk2": {
+      "fetcher": "github",
+      "owner": "tianocore",
+      "repo": "edk2",
+      "tag": "edk2-stable202511",
+      "hash": "sha256-R/rgz8dWcDYVoiM67K2UGuq0xXbjjJYBPtJ1FmfGIaU=",
+      "submodules": true
+    },
+    "edk2-non-osi": {
+      "fetcher": "github",
+      "owner": "tianocore",
+      "repo": "edk2-non-osi",
+      "rev": "94d048981116e2e3eda52dad1a89958ee404098d",
+      "hash": "sha256-6yuvVvmGn4yaEksbbvGDX1ZcKpdWBKnwaNjLGvgAWyk="
+    },
+    "edk2-platforms": {
+      "fetcher": "github",
+      "owner": "tianocore",
+      "repo": "edk2-platforms",
+      "rev": "0991a0b643509d900e5d023a0116789827a696e5",
+      "hash": "sha256-IdACr0NStqEpC0TFoKKgDwKT2mqyJwVXW/B7hlRXccI="
+    }
+  },
+  "variants": {
+    "mjallen": {
+      "sources": {
+        "edk2": {
+          "owner": "mjallen18",
+          "repo": "edk2",
+          "rev": "9765be56f1f816ef737153f5588b3294fcc69a63",
+          "tag": null,
+          "hash": "sha256-oqfJbNeOj2BVJqWE+snD6ri3lUO1aNcmPg+eJpjyr5E=",
+          "submodules": true
+        },
+        "edk2-non-osi": {
+          "owner": "mjallen18",
+          "repo": "edk2-non-osi",
+          "rev": "09ee44f07ded544d976be8a03dec3715719f638e",
+          "hash": "sha256-k7nUb3WaRUIr9IlXdam2WGKPOzKjLNVFLfuD5h4veMc="
+        },
+        "edk2-platforms": {
+          "owner": "mjallen18",
+          "repo": "edk2-platforms",
+          "rev": "fdf5a10cc60d1f01030e3ded3c6e69179819cd20",
+          "hash": "sha256-kc5kMEZNLxWFUN8n5+NxXNphkXAtVyjvSAuFyljb8Cs="
+        }
+      }
+    }
+  }
+}

packages/edk2/versions.json

@@ -1,44 +0,0 @@
-{
-  "edk2": {
-    "hash": "sha256-R/rgz8dWcDYVoiM67K2UGuq0xXbjjJYBPtJ1FmfGIaU=",
-    "location": "github",
-    "owner": "tianocore",
-    "repo": "edk2",
-    "tag": "edk2-stable202511"
-  },
-  "edk2-non-osi": {
-    "hash": "sha256-6yuvVvmGn4yaEksbbvGDX1ZcKpdWBKnwaNjLGvgAWyk=",
-    "location": "github",
-    "owner": "tianocore",
-    "repo": "edk2-non-osi",
-    "rev": "94d048981116e2e3eda52dad1a89958ee404098d"
-  },
-  "edk2-platforms": {
-    "hash": "sha256-IdACr0NStqEpC0TFoKKgDwKT2mqyJwVXW/B7hlRXccI=",
-    "location": "github",
-    "owner": "tianocore",
-    "repo": "edk2-platforms",
-    "rev": "0991a0b643509d900e5d023a0116789827a696e5"
-  },
-  "edk2-mjallen": {
-    "hash": "sha256-oqfJbNeOj2BVJqWE+snD6ri3lUO1aNcmPg+eJpjyr5E=",
-    "location": "github",
-    "owner": "mjallen18",
-    "repo": "edk2",
-    "rev": "9765be56f1f816ef737153f5588b3294fcc69a63"
-  },
-  "edk2-non-osi-mjallen": {
-    "hash": "sha256-k7nUb3WaRUIr9IlXdam2WGKPOzKjLNVFLfuD5h4veMc=",
-    "location": "github",
-    "owner": "mjallen18",
-    "repo": "edk2-non-osi",
-    "rev": "09ee44f07ded544d976be8a03dec3715719f638e"
-  },
-  "edk2-platforms-mjallen": {
-    "hash": "sha256-kc5kMEZNLxWFUN8n5+NxXNphkXAtVyjvSAuFyljb8Cs=",
-    "location": "github",
-    "owner": "mjallen18",
-    "repo": "edk2-platforms",
-    "rev": "fdf5a10cc60d1f01030e3ded3c6e69179819cd20"
-  }
-}

packages/librepods-beta/default.nix

@@ -14,21 +14,20 @@
   expat,
   fontconfig,
   freetype,
+  pkgs,
 }:
 let
   inherit (lib.trivial) importJSON;
-  versions = importJSON ./versions.json;
+  versionSpec = importJSON ./version.json;
+  versioning = import ../../lib/versioning.nix { inherit lib pkgs; };
+  selected = versioning.selectVariant versionSpec null null;
+  sources = versioning.mkAllSources selected;
 in
 rustPlatform.buildRustPackage rec {
   pname = "librepods";
   version = "0.1.0";
 
-  src = fetchFromGitHub {
+  src = sources.librepods;
-    owner = "kavishdevar";
-    repo = "librepods";
-    rev = versions.rev;
-    hash = versions.hash;
-  };
 
   sourceRoot = "${src.name}/linux-rust";
 

packages/librepods-beta/version.json

@@ -0,0 +1,11 @@
+{
+  "schemaVersion": 1,
+  "sources": {
+    "librepods": {
+      "fetcher": "git",
+      "url": "https://github.com/kavishdevar/librepods",
+      "rev": "c852b726deb5344ea3637332722a7c93f3858d60",
+      "hash": "sha256-RoOkINI+ahepAbgwdkcl1iI9XGI/gYXWiH0J9Eb90pg="
+    }
+  }
+}

packages/librepods-beta/versions.json

@@ -1,5 +0,0 @@
-{
-    "repo": "https://github.com/kavishdevar/librepods",
-    "rev": "c852b726deb5344ea3637332722a7c93f3858d60",
-    "hash": "sha256-RoOkINI+ahepAbgwdkcl1iI9XGI/gYXWiH0J9Eb90pg="
-}

packages/librepods/default.nix

@@ -8,21 +8,20 @@
   python3,
   libpulseaudio,
   fetchFromGitHub,
+  pkgs,
 }:
 let
   inherit (lib.trivial) importJSON;
-  versions = importJSON ./versions.json;
+  versionSpec = importJSON ./version.json;
+  versioning = import ../../lib/versioning.nix { inherit lib pkgs; };
+  selected = versioning.selectVariant versionSpec null null;
+  sources = versioning.mkAllSources selected;
 in
 stdenv.mkDerivation {
   pname = "librepods";
   version = "unstable";
 
-  src = fetchFromGitHub {
+  src = sources.librepods;
-    owner = "kavishdevar";
-    repo = "librepods";
-    rev = versions.rev;
-    hash = versions.hash;
-  };
 
   sourceRoot = "source/linux";
 

packages/librepods/version.json

@@ -0,0 +1,11 @@
+{
+  "schemaVersion": 1,
+  "sources": {
+    "librepods": {
+      "fetcher": "git",
+      "url": "https://github.com/kavishdevar/librepods",
+      "rev": "287163e116d092485d561ad571dae03a2f43cf2f",
+      "hash": "sha256-PD5U87RVBRCLWwnN54x3AEey6wqoOeZlBvzyIESH1v8="
+    }
+  }
+}

packages/librepods/versions.json

@@ -1,6 +0,0 @@
-{
-    "repo": "https://github.com/kavishdevar/librepods",
-    "rev": "287163e116d092485d561ad571dae03a2f43cf2f",
-    "hash": "sha256-PD5U87RVBRCLWwnN54x3AEey6wqoOeZlBvzyIESH1v8="
-  }
-  

packages/linux-cachyos/default.nix

@@ -20,10 +20,36 @@ let
   # ######################################################
   #                   Source Versions                    #
   # ######################################################
-  mainVersions = importJSON ./versions.json;
+  versionSpec = importJSON ./version.json;
-  ltsVersions = importJSON ./versions-lts.json;
+  versioning = import ../../lib/versioning.nix { inherit lib pkgs; };
-  rcVersions = importJSON ./versions-rc.json;
+  mkVersions = selected:
-  hardenedVersions = importJSON ./versions-hardened.json;
+    let
+      s = selected.sources;
+      vars = selected.variables or {};
+    in
+    {
+      suffix = vars.suffix or "";
+      linux = {
+        inherit (s.linux) version hash;
+      };
+      config = {
+        rev = s.config.rev;
+        hash = s.config.hash;
+      };
+      patches = {
+        rev = s.patches.rev;
+        hash = s.patches.hash;
+      };
+      zfs = {
+        rev = s.zfs.rev;
+        hash = s.zfs.hash;
+      };
+    };
+
+  mainVersions = mkVersions (versioning.selectVariant versionSpec null null);
+  ltsVersions = mkVersions (versioning.selectVariant versionSpec "lts" null);
+  rcVersions = mkVersions (versioning.selectVariant versionSpec "rc" null);
+  hardenedVersions = mkVersions (versioning.selectVariant versionSpec "hardened" null);
 
   # ######################################################
   #                   Base LTO Config                    #

packages/linux-cachyos/version.json

@@ -0,0 +1,70 @@
+{
+  "schemaVersion": 1,
+  "variables": {
+    "suffix": "-cachyos"
+  },
+  "sources": {
+    "linux": {
+      "fetcher": "none",
+      "version": "6.18.6",
+      "hash": "sha256-RySXGXsvaNTb8bwyzG3GacoiD/TA6w3Dmpz/moj5oxs="
+    },
+    "config": {
+      "fetcher": "github",
+      "owner": "CachyOS",
+      "repo": "linux-cachyos",
+      "rev": "fb8c750d869dde6aad11c04c1b2cd311d24bde2c",
+      "hash": "sha256-svJgugxjC5d7fpPkP2AbzcuiKnUXnI0uzlyq2mjXQFA="
+    },
+    "patches": {
+      "fetcher": "github",
+      "owner": "CachyOS",
+      "repo": "kernel-patches",
+      "rev": "cec2d1841baae411313742083ef2bc0b29855b4d",
+      "hash": "sha256-VV0AMYlSIVYbJNzKymnGGSlBcPoahMxeASbVi+fTtHo="
+    },
+    "zfs": {
+      "fetcher": "git",
+      "url": "https://github.com/cachyos/zfs.git",
+      "rev": "743334913e5a5f60baf287bcc6d8a23515b02ac5",
+      "hash": "sha256-v78Tn1Im9h8Sjd4XACYesPOD+hlUR3Cmg8XjcJXOuwM="
+    }
+  },
+  "variants": {
+    "lts": {
+      "sources": {
+        "linux": {
+          "version": "6.12.66",
+          "hash": "sha256-ujiXocBgsFoDy03abyDYx15vc8iLIXdEgjqRUFZTbq8="
+        }
+      }
+    },
+    "rc": {
+      "sources": {
+        "linux": {
+          "version": "6.19-rc6",
+          "hash": "sha256-tF+ApUubv/UucqXudLQDKw7j5rjYZ/odxgInfexCQDQ="
+        },
+        "zfs": {
+          "rev": "540cd8029042327a37fd2a3614f8e623cbb87a22",
+          "hash": "sha256-KaN24a1nXwOoHahglRWSypqxlE5jMuuZVIOVd1CDrqQ="
+        }
+      }
+    },
+    "hardened": {
+      "sources": {
+        "linux": {
+          "version": "6.17.13",
+          "hash": "sha256-EWgC3DrRZGFjzG/+m926JKgGm1aRNewFI815kGTy7bk="
+        }
+      }
+    }
+  },
+  "notes": {
+    "suffix": "Matches `Add-extra-version-CachyOS.patch`",
+    "linux": "pkgver from config's PKGBUILD",
+    "config": "latest commit from https://github.com/CachyOS/linux-cachyos/commits/master/linux-cachyos",
+    "patches": "latest commit from https://github.com/CachyOS/kernel-patches/commits/master/x.y",
+    "zfs": "search for `git+https://github.com/cachyos/zfs.git` in config's PKGBUILD"
+  }
+}

packages/linux-cachyos/versions-hardened.json

@@ -1,19 +0,0 @@
-{
-  "suffix": "-cachyos",
-  "linux": {
-    "version": "6.17.13",
-    "hash": "sha256-EWgC3DrRZGFjzG/+m926JKgGm1aRNewFI815kGTy7bk="
-  },
-  "config": {
-    "rev": "fb8c750d869dde6aad11c04c1b2cd311d24bde2c",
-    "hash": "sha256-svJgugxjC5d7fpPkP2AbzcuiKnUXnI0uzlyq2mjXQFA="
-  },
-  "patches": {
-    "rev": "cec2d1841baae411313742083ef2bc0b29855b4d",
-    "hash": "sha256-VV0AMYlSIVYbJNzKymnGGSlBcPoahMxeASbVi+fTtHo="
-  },
-  "zfs": {
-    "rev": "743334913e5a5f60baf287bcc6d8a23515b02ac5",
-    "hash": "sha256-VV0AMYlSIVYbJNzKymnGGSlBcPoahMxeASbVi+fTtHo="
-  }
-}

packages/linux-cachyos/versions-lts.json

@@ -1,19 +0,0 @@
-{
-  "suffix": "-cachyos",
-  "linux": {
-    "version": "6.12.66",
-    "hash": "sha256-ujiXocBgsFoDy03abyDYx15vc8iLIXdEgjqRUFZTbq8="
-  },
-  "config": {
-    "rev": "fb8c750d869dde6aad11c04c1b2cd311d24bde2c",
-    "hash": "sha256-svJgugxjC5d7fpPkP2AbzcuiKnUXnI0uzlyq2mjXQFA="
-  },
-  "patches": {
-    "rev": "cec2d1841baae411313742083ef2bc0b29855b4d",
-    "hash": "sha256-VV0AMYlSIVYbJNzKymnGGSlBcPoahMxeASbVi+fTtHo="
-  },
-  "zfs": {
-    "rev": "743334913e5a5f60baf287bcc6d8a23515b02ac5",
-    "hash": "sha256-v78Tn1Im9h8Sjd4XACYesPOD+hlUR3Cmg8XjcJXOuwM="
-  }
-}

packages/linux-cachyos/versions-rc.json

@@ -1,19 +0,0 @@
-{
-  "suffix": "-cachyos",
-  "linux": {
-    "version": "6.19-rc6",
-    "hash": "sha256-tF+ApUubv/UucqXudLQDKw7j5rjYZ/odxgInfexCQDQ="
-  },
-  "config": {
-    "rev": "fb8c750d869dde6aad11c04c1b2cd311d24bde2c",
-    "hash": "sha256-svJgugxjC5d7fpPkP2AbzcuiKnUXnI0uzlyq2mjXQFA="
-  },
-  "patches": {
-    "rev": "cec2d1841baae411313742083ef2bc0b29855b4d",
-    "hash": "sha256-VV0AMYlSIVYbJNzKymnGGSlBcPoahMxeASbVi+fTtHo="
-  },
-  "zfs": {
-    "rev": "540cd8029042327a37fd2a3614f8e623cbb87a22",
-    "hash": "sha256-KaN24a1nXwOoHahglRWSypqxlE5jMuuZVIOVd1CDrqQ="
-  }
-}

packages/linux-cachyos/versions.json

@@ -1,24 +0,0 @@
-{
-  "_suffix": "Matches `Add-extra-version-CachyOS.patch`",
-  "suffix": "-cachyos",
-  "_linux": "pkgver from config's PKGBUILD",
-  "linux": {
-    "version": "6.18.6",
-    "hash": "sha256-RySXGXsvaNTb8bwyzG3GacoiD/TA6w3Dmpz/moj5oxs="
-  },
-  "_config": "latest commit from https://github.com/CachyOS/linux-cachyos/commits/master/linux-cachyos",
-  "config": {
-    "rev": "fb8c750d869dde6aad11c04c1b2cd311d24bde2c",
-    "hash": "sha256-svJgugxjC5d7fpPkP2AbzcuiKnUXnI0uzlyq2mjXQFA="
-  },
-  "_patches": "latest commit from https://github.com/CachyOS/kernel-patches/commits/master/x.y",
-  "patches": {
-    "rev": "cec2d1841baae411313742083ef2bc0b29855b4d",
-    "hash": "sha256-VV0AMYlSIVYbJNzKymnGGSlBcPoahMxeASbVi+fTtHo="
-  },
-  "_zfs": "search for `git+https://github.com/cachyos/zfs.git` in config's PKGBUILD",
-  "zfs": {
-    "rev": "743334913e5a5f60baf287bcc6d8a23515b02ac5",
-    "hash": "sha256-v78Tn1Im9h8Sjd4XACYesPOD+hlUR3Cmg8XjcJXOuwM="
-  }
-}

packages/proton-cachyos/cachyos-v2-version.json

@@ -1,5 +0,0 @@
-{
-  "base": "10.0",
-  "release": "20251222",
-  "hash": "sha256-S5i8RBbrPAlsYYavzzhTFanLU3uyLT3OQRpX9S6pPE0="
-}

packages/proton-cachyos/cachyos-v3-version.json

@@ -1,5 +0,0 @@
-{
-  "base": "10.0",
-  "release": "20251222",
-  "hash": "sha256-tw1/uX4qZX3cQKyzsss8l+wHKLoJF2/8B+6RUIQt4oQ="
-}

packages/proton-cachyos/cachyos-v4-version.json

@@ -1,5 +0,0 @@
-{
-  "base": "10.0",
-  "release": "20251222",
-  "hash": "sha256-1+6nCUc93vVZg3j4oSwuM7DYOZ2bNbLIjbH+8OUOSAQ="
-}

packages/proton-cachyos/cachyos-version.json

@@ -1,5 +0,0 @@
-{
-  "base": "10.0",
-  "release": "20251222",
-  "hash": "sha256-W7cC4pi8WED4rOEXYVXIio1tiUNvArzqsTl6xKwy/mY="
-}

packages/proton-cachyos/default.nix

@@ -4,24 +4,39 @@
   lib,
   fetchurl,
   fetchzip,
-  # Required
+  pkgs,
-  versionFilename ? "cachyos-v4-version.json",
+  # Repo metadata
   owner ? "CachyOS",
   repo ? "proton-cachyos",
-  # Optional
+  # Behavior
   withUpdateScript ? true,
+  # Variant selection (null -> use defaultVariant from version.json)
+  variant ? null,
+  # Packaging/customization knobs
   toolTitle ? null,
   toolPattern ? "proton-.*",
   tarballPrefix ? "proton-",
   tarballSuffix ? "-x86_64_v4.tar.xz",
   releasePrefix ? "cachyos-",
   releaseSuffix ? "-slr",
-  version ? lib.trivial.importJSON ./${versionFilename},
-  releaseVersion ? "${releasePrefix}${version.base}-${version.release}${releaseSuffix}",
-  homepage ? "https://github.com/${owner}/${repo}",
-  url ? "${homepage}/releases/download/${releaseVersion}/${tarballPrefix}${releaseVersion}${tarballSuffix}",
 }:
 let
+  inherit (lib.trivial) importJSON;
+
+  # Load unified version spec and select the desired variant
+  versionSpec = importJSON ./version.json;
+  versioning = import ../../lib/versioning.nix { inherit lib pkgs; };
+  selected = versioning.selectVariant versionSpec variant null;
+  vars = selected.variables or {};
+  base = vars.base;
+  release = vars.release;
+
+  # Derived values for the current variant
+  releaseVersion = "${releasePrefix}${base}-${release}${releaseSuffix}";
+  homepage = "https://github.com/${owner}/${repo}";
+  url = "${homepage}/releases/download/${releaseVersion}/${tarballPrefix}${releaseVersion}${tarballSuffix}";
+
+  # Choose fetcher based on file type
   intake =
     if lib.strings.hasSuffix ".zip" url then
       {
@@ -36,11 +51,11 @@ let
 in
 stdenvNoCC.mkDerivation {
   name = repo;
-  version = "${version.base}.${version.release}";
+  version = "${base}.${release}";
 
   src = intake.fetcher {
     inherit url;
-    inherit (version) hash;
+    hash = selected.sources.proton.hash;
   };
 
   buildCommand = ''
@@ -61,10 +76,11 @@ stdenvNoCC.mkDerivation {
             tarballSuffix
             releasePrefix
             releaseSuffix
-            versionFilename
             owner
             repo
             ;
+          # Prefer explicit variant, otherwise use defaultVariant from the spec
+          variant = if variant != null then variant else (versionSpec.defaultVariant or "cachyos");
         };
       }
     else

packages/proton-cachyos/ge-version.json

@@ -1,5 +0,0 @@
-{
-  "base": "10",
-  "release": "26",
-  "hash": "sha256-4v/Z0qHs4wtdo9PcnO2qgodQCNHJhLXvx2ZsAoID+ds="
-}

packages/proton-cachyos/update.nix

@@ -16,9 +16,10 @@
   tarballSuffix,
   releasePrefix,
   releaseSuffix,
-  versionFilename,
   owner,
   repo,
+  # New: which variant to update (defaults to version.json's defaultVariant)
+  variant ? null,
 }:
 let
   path = lib.makeBinPath [
@@ -38,26 +39,57 @@ writeShellScript "update-${repo}" ''
   set -euo pipefail
   PATH=${path}
 
-  srcJson=pkgs/proton-bin/${versionFilename}
+  repoRoot="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
-  localBase=$(jq -r .base < $srcJson)
+  versionFile="$repoRoot/packages/proton-cachyos/version.json"
-  localRelease=$(jq -r .release < $srcJson)
 
-  latestVer=$(curl 'https://github.com/${owner}/${repo}/releases.atom' | xq -r '.feed.entry[].link."@href"' | grep -Po '(?<=/)${releasePrefix}[^/]+${releaseSuffix}$' | head -n 1)
+  # Determine variant to update (prefer CLI arg, else defaultVariant in file)
+  variantEff="${variant:-}"
+  if [ -z "$variantEff" ]; then
+    variantEff="$(jq -r '.defaultVariant // empty' "$versionFile")"
+  fi
+  if [ -z "$variantEff" ]; then
+    variantEff="cachyos"
+  fi
 
-  if [ "${releasePrefix}''${localBase}-''${localRelease}${releaseSuffix}" == "$latestVer" ]; then
+  # Read current values from the unified version.json
+  localBase="$(jq -r --arg v "$variantEff" '.variants[$v].variables.base' "$versionFile")"
+  localRelease="$(jq -r --arg v "$variantEff" '.variants[$v].variables.release' "$versionFile")"
+  localHash="$(jq -r --arg v "$variantEff" '.variants[$v].sources.proton.hash' "$versionFile")"
+
+  # Discover latest release tag
+  latestVer="$(
+    curl -fsSL "https://github.com/${owner}/${repo}/releases.atom" \
+      | xq -r '.feed.entry[].link."@href"' \
+      | grep -Po "(?<=/)${releasePrefix}[^/]+${releaseSuffix}$" \
+      | head -n 1
+  )"
+
+  if [ "${releasePrefix}''${localBase}-''${localRelease}${releaseSuffix}" = "$latestVer" ]; then
+    echo "No update needed for variant '$variantEff' (${localBase}.${localRelease})."
     exit 0
   fi
 
-  latestBase=$(echo $latestVer | grep -Po '(?<=^${releasePrefix})[^-]+')
+  latestBase="$(echo "$latestVer" | grep -Po "(?<=^${releasePrefix})[^-]+")"
-  latestRelease=$(echo $latestVer | grep -Po '(?<=-)[^-]+(?=${releaseSuffix}$)')
+  latestRelease="$(echo "$latestVer" | grep -Po "(?<=-)[^-]+(?=${releaseSuffix}$)")"
-  latestSha256=$(nix-prefetch-url --type sha256 "https://github.com/${owner}/${repo}/releases/download/''${latestVer}/${tarballPrefix}''${latestVer}${tarballSuffix}")
+  artifactUrl="https://github.com/${owner}/${repo}/releases/download/''${latestVer}/${tarballPrefix}''${latestVer}${tarballSuffix}"
-  latestHash=$(nix-hash --to-sri --type sha256 $latestSha256)
 
+  latestSha256="$(nix-prefetch-url --type sha256 "$artifactUrl")"
+  latestHash="$(nix-hash --to-sri --type sha256 "$latestSha256")"
+
+  # Update the selected variant in version.json
+  tmp="$(mktemp)"
   jq \
-    --arg latestBase "$latestBase" --arg latestRelease "$latestRelease" --arg latestHash "$latestHash" \
+    --arg v "$variantEff" \
-    '.base = $latestBase | .release = $latestRelease | .hash = $latestHash' \
+    --arg latestBase "$latestBase" \
-    "$srcJson" | sponge "$srcJson"
+    --arg latestRelease "$latestRelease" \
+    --arg latestHash "$latestHash" \
+    '
+      .variants[$v].variables.base = $latestBase
+      | .variants[$v].variables.release = $latestRelease
+      | .variants[$v].sources.proton.hash = $latestHash
+    ' "$versionFile" > "$tmp"
+  mv "$tmp" "$versionFile"
 
-  git add $srcJson
+  git -C "$repoRoot" add "packages/proton-cachyos/version.json"
-  git commit -m "${repo}: ''${localBase}.''${localRelease} -> ''${latestBase}.''${latestRelease}"
+  git -C "$repoRoot" commit -m "${repo}(${variantEff}): ''${localBase}.''${localRelease} -> ''${latestBase}.''${latestRelease}"
 ''

packages/proton-cachyos/version.json

@@ -0,0 +1,69 @@
+{
+  "schemaVersion": 1,
+  "defaultVariant": "cachyos-v4",
+  "sources": {
+    "proton": {
+      "fetcher": "none"
+    }
+  },
+  "variants": {
+    "cachyos": {
+      "variables": {
+        "base": "10.0",
+        "release": "20251222"
+      },
+      "sources": {
+        "proton": {
+          "hash": "sha256-W7cC4pi8WED4rOEXYVXIio1tiUNvArzqsTl6xKwy/mY="
+        }
+      }
+    },
+    "cachyos-v2": {
+      "variables": {
+        "base": "10.0",
+        "release": "20251222"
+      },
+      "sources": {
+        "proton": {
+          "hash": "sha256-S5i8RBbrPAlsYYavzzhTFanLU3uyLT3OQRpX9S6pPE0="
+        }
+      }
+    },
+    "cachyos-v3": {
+      "variables": {
+        "base": "10.0",
+        "release": "20251222"
+      },
+      "sources": {
+        "proton": {
+          "hash": "sha256-tw1/uX4qZX3cQKyzsss8l+wHKLoJF2/8B+6RUIQt4oQ="
+        }
+      }
+    },
+    "cachyos-v4": {
+      "variables": {
+        "base": "10.0",
+        "release": "20251222"
+      },
+      "sources": {
+        "proton": {
+          "hash": "sha256-1+6nCUc93vVZg3j4oSwuM7DYOZ2bNbLIjbH+8OUOSAQ="
+        }
+      }
+    },
+    "ge": {
+      "variables": {
+        "base": "10",
+        "release": "26"
+      },
+      "sources": {
+        "proton": {
+          "hash": "sha256-4v/Z0qHs4wtdo9PcnO2qgodQCNHJhLXvx2ZsAoID+ds="
+        }
+      }
+    }
+  },
+  "notes": {
+    "consumption": "default.nix currently computes the URL from base/release and suffixes. With this schema, keep using those variables (variant.variables.base/release) and the per-variant proton.hash until migrated to an explicit urlTemplate."
+  }
+}

packages/raspberrypi/ffmpeg-rpi/default.nix

@@ -9,19 +9,21 @@
   udev,
   systemd,
   withVoutDrm ? true,
+  pkgs,
 }:
 
 let
-  extraVersion = "rpi";
+  inherit (lib.trivial) importJSON;
+  versionSpec = importJSON ./version.json;
+  versioning = import ../../../lib/versioning.nix { inherit lib pkgs; };
+  selected = versioning.selectVariant versionSpec null null;
+  vars = selected.variables or {};
+  sources = versioning.mkAllSources selected;
+
+  extraVersion = vars.extraVersion or "rpi";
   # https://github.com/jc-kynesim/rpi-ffmpeg/tree/test/7.1.2/main
-  ffmpegVersion = "7.1.2";
+  ffmpegVersion = vars.ffmpegVersion or "7.1.2";
-  rpiFfmpegSrc = fetchFromGitHub {
+  rpiFfmpegSrc = sources."rpi-ffmpeg";
-    owner = "jc-kynesim";
-    repo = "rpi-ffmpeg";
-    # rev   = "test/${ffmpegVersion}/main"; # this branch is being forced-push to
-    rev = "de943d66dab18e89fc10c74459bea1d787edc49d";
-    hash = "sha256-Qbgos7uzYXF5E557kR2EXhX9eJRmO0LVmSE2NOpEZY0=";
-  };
 
 in
 (ffmpeg.overrideAttrs (old: {

packages/raspberrypi/ffmpeg-rpi/version.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": 1,
+  "variables": {
+    "ffmpegVersion": "7.1.2",
+    "extraVersion": "rpi"
+  },
+  "sources": {
+    "rpi-ffmpeg": {
+      "fetcher": "github",
+      "owner": "jc-kynesim",
+      "repo": "rpi-ffmpeg",
+      "rev": "de943d66dab18e89fc10c74459bea1d787edc49d",
+      "hash": "sha256-Qbgos7uzYXF5E557kR2EXhX9eJRmO0LVmSE2NOpEZY0="
+    }
+  }
+}

packages/raspberrypi/libraspberrypi/default.nix

@@ -4,17 +4,20 @@
   fetchFromGitHub,
   cmake,
   pkg-config,
+  pkgs,
 }:
+let
+  inherit (lib.trivial) importJSON;
+  versionSpec = importJSON ./version.json;
+  versioning = import ../../../lib/versioning.nix { inherit lib pkgs; };
+  selected = versioning.selectVariant versionSpec null null;
+  sources = versioning.mkAllSources selected;
+in
 stdenv.mkDerivation (_finalAttrs: {
   pname = "libraspberrypi";
   version = "unstable-2024-12-23";
 
-  src = fetchFromGitHub {
+  src = sources.userland;
-    owner = "raspberrypi";
-    repo = "userland";
-    rev = "a54a0dbb2b8dcf9bafdddfc9a9374fb51d97e976";
-    hash = "sha256-Edca6nkykdXKFF5MGq6LeKirMLHTZBCbFWvHTNHMWJ4=";
-  };
 
   nativeBuildInputs = [
     cmake

packages/raspberrypi/libraspberrypi/version.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": 1,
+  "sources": {
+    "userland": {
+      "fetcher": "github",
+      "owner": "raspberrypi",
+      "repo": "userland",
+      "rev": "a54a0dbb2b8dcf9bafdddfc9a9374fb51d97e976",
+      "hash": "sha256-Edca6nkykdXKFF5MGq6LeKirMLHTZBCbFWvHTNHMWJ4="
+    }
+  }
+}

packages/raspberrypi/linux-rpi/default.nix

@@ -4,15 +4,22 @@
   lib,
   fetchFromGitHub,
   buildLinux,
+  pkgs,
   rpiVersion ? 5,
   ...
 }@args:
 
 let
   # stdenv = ccacheStdenv;
-  modDirVersion = "6.12.47";
+  inherit (lib.trivial) importJSON;
-  tag = "stable_20250916";
+  versionSpec = importJSON ./version.json;
-  hash = "sha256-HG8Oc04V2t54l0SOn4gKmNJWQUrZfjWusgKcWvx74H0==";
+  versioning = import ../../../lib/versioning.nix { inherit lib pkgs; };
+  selected = versioning.selectVariant versionSpec null null;
+  vars = selected.variables or {};
+  sources = versioning.mkAllSources selected;
+
+  modDirVersion = vars.modDirVersion;
+  tag = vars.tag;
   # NOTE: raspberrypifw & raspberryPiWirelessFirmware should be updated with this
 
   # all of these fail for various reasons
@@ -43,11 +50,7 @@ lib.overrideDerivation
       inherit modDirVersion;
       pname = "linux-rpi${toString rpiVersion}";
 
-      src = fetchFromGitHub {
+      src = sources.kernel;
-        owner = "raspberrypi";
-        repo = "linux";
-        inherit tag hash;
-      };
 
       defconfig =
         {

packages/raspberrypi/linux-rpi/version.json

@@ -0,0 +1,19 @@
+{
+  "schemaVersion": 1,
+  "variables": {
+    "modDirVersion": "6.12.47",
+    "tag": "stable_20250916"
+  },
+  "sources": {
+    "kernel": {
+      "fetcher": "github",
+      "owner": "raspberrypi",
+      "repo": "linux",
+      "tag": "${tag}",
+      "hash": "sha256-HG8Oc04V2t54l0SOn4gKmNJWQUrZfjWusgKcWvx74H0=="
+    }
+  },
+  "notes": {
+    "hint": "raspberrypifw & raspberryPiWirelessFirmware should be updated alongside this."
+  }
+}

packages/raspberrypi/raspberryPiWirelessFirmware/default.nix

@@ -2,27 +2,23 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
+  pkgs,
 }:
+let
+  inherit (lib.trivial) importJSON;
+  versionSpec = importJSON ./version.json;
+  versioning = import ../../../lib/versioning.nix { inherit lib pkgs; };
+  selected = versioning.selectVariant versionSpec null null;
+  sources = versioning.mkAllSources selected;
+in
 
 stdenvNoCC.mkDerivation {
   pname = "raspberrypi-wireless-firmware";
   version = "0-unstable-2025-04-08";
 
   srcs = [
-    (fetchFromGitHub {
+    sources."bluez-firmware"
-      name = "bluez-firmware";
+    sources."firmware-nonfree"
-      owner = "RPi-Distro";
-      repo = "bluez-firmware";
-      rev = "cdf61dc691a49ff01a124752bd04194907f0f9cd";
-      hash = "sha256-35pnbQV/zcikz9Vic+2a1QAS72riruKklV8JHboL9NY=";
-    })
-    (fetchFromGitHub {
-      name = "firmware-nonfree";
-      owner = "RPi-Distro";
-      repo = "firmware-nonfree";
-      rev = "40dea60e27078fac57a3fed51010e2c26865d49b";
-      hash = "sha256-yXKzrkr7zdw/ba8GEi0r+XjnZEsQ59LPEuXj0HaKwxU=";
-    })
   ];
 
   sourceRoot = ".";

packages/raspberrypi/raspberryPiWirelessFirmware/version.json

@@ -0,0 +1,21 @@
+{
+  "schemaVersion": 1,
+  "sources": {
+    "bluez-firmware": {
+      "fetcher": "github",
+      "name": "bluez-firmware",
+      "owner": "RPi-Distro",
+      "repo": "bluez-firmware",
+      "rev": "cdf61dc691a49ff01a124752bd04194907f0f9cd",
+      "hash": "sha256-35pnbQV/zcikz9Vic+2a1QAS72riruKklV8JHboL9NY="
+    },
+    "firmware-nonfree": {
+      "fetcher": "github",
+      "name": "firmware-nonfree",
+      "owner": "RPi-Distro",
+      "repo": "firmware-nonfree",
+      "rev": "40dea60e27078fac57a3fed51010e2c26865d49b",
+      "hash": "sha256-yXKzrkr7zdw/ba8GEi0r+XjnZEsQ59LPEuXj0HaKwxU="
+    }
+  }
+}

packages/raspberrypi/raspberrypi-overlays/default.nix

@@ -2,19 +2,23 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
+  pkgs,
 }:
+let
+  inherit (lib.trivial) importJSON;
+  versionSpec = importJSON ./version.json;
+  versioning = import ../../../lib/versioning.nix { inherit lib pkgs; };
+  selected = versioning.selectVariant versionSpec null null;
+  vars = selected.variables or {};
+  sources = versioning.mkAllSources selected;
+in
 
 stdenvNoCC.mkDerivation rec {
   # NOTE: this should be updated with linux_rpi
   pname = "raspberrypi-dtoverlays";
-  version = "stable_20250916";
+  version = vars.version;
 
-  src = fetchFromGitHub {
+  src = sources.linux;
-    owner = "raspberrypi";
-    repo = "linux";
-    tag = version;
-    hash = "sha256-HG8Oc04V2t54l0SOn4gKmNJWQUrZfjWusgKcWvx74H0==";
-  };
 
   installPhase = ''
     mkdir -p $out/dtbs/raspberrypi-overlays/

packages/raspberrypi/raspberrypi-overlays/version.json

@@ -0,0 +1,15 @@
+{
+  "schemaVersion": 1,
+  "variables": {
+    "version": "stable_20250916"
+  },
+  "sources": {
+    "linux": {
+      "fetcher": "github",
+      "owner": "raspberrypi",
+      "repo": "linux",
+      "tag": "${version}",
+      "hash": "sha256-HG8Oc04V2t54l0SOn4gKmNJWQUrZfjWusgKcWvx74H0=="
+    }
+  }
+}

packages/raspberrypi/raspberrypi-utils/default.nix

@@ -6,17 +6,20 @@
   fetchFromGitHub,
   cmake,
   dtc,
+  pkgs,
 }:
+let
+  inherit (lib.trivial) importJSON;
+  versionSpec = importJSON ./version.json;
+  versioning = import ../../../lib/versioning.nix { inherit lib pkgs; };
+  selected = versioning.selectVariant versionSpec null null;
+  sources = versioning.mkAllSources selected;
+in
 stdenv.mkDerivation (_finalAttrs: {
   pname = "raspberrypi-utils";
   version = "unstable-2025-12-26";
 
-  src = fetchFromGitHub {
+  src = sources.utils;
-    owner = "raspberrypi";
-    repo = "utils";
-    rev = "230d67ad28e74b17a42064453b2163991cb51a5e";
-    hash = "sha256-x3E8DwKKCmjxloCRB8djqNwuyrR4rok+JcNgPQ1ZH3Y=";
-  };
 
   buildInputs = [
     dtc # dtmerge depends on libfdt

packages/raspberrypi/raspberrypi-utils/version.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": 1,
+  "sources": {
+    "utils": {
+      "fetcher": "github",
+      "owner": "raspberrypi",
+      "repo": "utils",
+      "rev": "230d67ad28e74b17a42064453b2163991cb51a5e",
+      "hash": "sha256-x3E8DwKKCmjxloCRB8djqNwuyrR4rok+JcNgPQ1ZH3Y="
+    }
+  }
+}

packages/raspberrypi/raspberrypifw/default.nix

@@ -2,19 +2,22 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
+  pkgs,
 }:
-
+let
+  inherit (lib.trivial) importJSON;
+  versionSpec = importJSON ./version.json;
+  versioning = import ../../../lib/versioning.nix { inherit lib pkgs; };
+  selected = versioning.selectVariant versionSpec null null;
+  vars = selected.variables or {};
+  sources = versioning.mkAllSources selected;
+in
 stdenvNoCC.mkDerivation rec {
   # NOTE: this should be updated with linux_rpi
   pname = "raspberrypi-firmware";
-  version = "1.20250915";
+  version = vars.version;
 
-  src = fetchFromGitHub {
+  src = sources.firmware;
-    owner = "raspberrypi";
-    repo = "firmware";
-    rev = version;
-    hash = "sha256-DqVgsPhppxCsZ+H6S7XY5bBoRhOgPipKibDwikqBk08=";
-  };
 
   installPhase = ''
     mkdir -p $out/share/raspberrypi/

packages/raspberrypi/raspberrypifw/version.json

@@ -0,0 +1,15 @@
+{
+  "schemaVersion": 1,
+  "variables": {
+    "version": "1.20250915"
+  },
+  "sources": {
+    "firmware": {
+      "fetcher": "github",
+      "owner": "raspberrypi",
+      "repo": "firmware",
+      "tag": "${version}",
+      "hash": "sha256-DqVgsPhppxCsZ+H6S7XY5bBoRhOgPipKibDwikqBk08="
+    }
+  }
+}

packages/raspberrypi/udev-rules/version.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": 1,
+  "sources": {
+    "sys-mods": {
+      "fetcher": "github",
+      "owner": "RPi-Distro",
+      "repo": "raspberrypi-sys-mods",
+      "rev": "063d092c528c09b9dad5d7ed187ebf110a53303b",
+      "hash": "sha256-vi89lzfuLS9xKHDnlpm7Aw1UCOGCcMfd0cQq0rA9yOQ="
+    }
+  }
+}

packages/raspberrypi/uefi-rpi4/default.nix

@@ -2,17 +2,21 @@
   lib,
   stdenvNoCC,
   fetchzip,
+  pkgs,
 }:
-
+let
+  inherit (lib.trivial) importJSON;
+  versionSpec = importJSON ./version.json;
+  versioning = import ../../../lib/versioning.nix { inherit lib pkgs; };
+  selected = versioning.selectVariant versionSpec null null;
+  vars = selected.variables or {};
+  sources = versioning.mkAllSources selected;
+in
 stdenvNoCC.mkDerivation rec {
   pname = "uefi-rpi4";
-  version = "1.50";
+  version = vars.version;
 
-  src = fetchzip {
+  src = sources.firmware;
-    url = "https://github.com/pftf/RPi4/releases/download/v${version}/RPi4_UEFI_Firmware_v${version}.zip";
-    stripRoot = false;
-    hash = "sha256-g8046/Ox0hZgvU6u3ZfC6HMqoTME0Y7NsZD6NvUsp7w=";
-  };
 
   sourceRoot = ".";
 

packages/raspberrypi/uefi-rpi4/version.json

@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "variables": {
+    "version": "1.50"
+  },
+  "sources": {
+    "firmware": {
+      "fetcher": "url",
+      "urlTemplate": "https://github.com/pftf/RPi4/releases/download/v${version}/RPi4_UEFI_Firmware_v${version}.zip",
+      "hash": "sha256-g8046/Ox0hZgvU6u3ZfC6HMqoTME0Y7NsZD6NvUsp7w=",
+      "extra": { "unpack": "zip", "stripRoot": false }
+    }
+  }
+}

packages/raspberrypi/uefi-rpi5/default.nix

@@ -2,8 +2,16 @@
   lib,
   stdenvNoCC,
   fetchurl,
+  pkgs,
 }:
 let
+  inherit (lib.trivial) importJSON;
+  versionSpec = importJSON ./version.json;
+  versioning = import ../../../lib/versioning.nix { inherit lib pkgs; };
+  selected = versioning.selectVariant versionSpec null null;
+  vars = selected.variables or {};
+  sources = versioning.mkAllSources selected;
+
   defaultConfig = ''
     EOF
     armstub=RPI_EFI.fd
@@ -41,12 +49,9 @@ let
 in
 stdenvNoCC.mkDerivation rec {
   pname = "uefi-rpi5";
-  version = "test1";
+  version = vars.version;
 
-  src = fetchurl {
+  src = sources.firmware;
-    url = "https://github.com/NumberOneGit/rpi5-uefi/releases/download/${version}/RPI_EFI.fd";
-    hash = "sha256-GIgru10KCol9PXcdgR2d1BHf2In07OQ2P1kru7GUupY=";
-  };
 
   sourceRoot = ".";
 

packages/raspberrypi/uefi-rpi5/version.json

@@ -0,0 +1,13 @@
+{
+  "schemaVersion": 1,
+  "variables": {
+    "version": "test1"
+  },
+  "sources": {
+    "firmware": {
+      "fetcher": "url",
+      "urlTemplate": "https://github.com/NumberOneGit/rpi5-uefi/releases/download/${version}/RPI_EFI.fd",
+      "hash": "sha256-GIgru10KCol9PXcdgR2d1BHf2In07OQ2P1kru7GUupY="
+    }
+  }
+}

packages/system/open-remote-ssh/default.nix

@@ -6,19 +6,21 @@
 }:
 
 let
-  version = "0.0.49";
+  inherit (lib.trivial) importJSON;
-  publisher = "jeanp413";
+  versionSpec = importJSON ./version.json;
-  name = "open-remote-ssh";
+  versioning = import ../../../lib/versioning.nix { inherit lib pkgs; };
+  selected = versioning.selectVariant versionSpec null null;
+  vars = selected.variables or {};
+  sources = versioning.mkAllSources selected;
 in
 vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
-    inherit name publisher version;
+    name = vars.name;
+    publisher = vars.publisher;
+    version = vars.version;
   };
 
-  vsix = fetchurl {
+  vsix = sources.vsix;
-    url = "https://open-vsx.org/api/${publisher}/${name}/${version}/file/${publisher}.${name}-${version}.vsix";
-    sha256 = "sha256-QfJnAAx+kO2iJ1EzWoO5HLogJKg3RiC3hg1/u2Jm6t4=";
-  };
 
   unpackPhase = ''
     ${lib.getExe pkgs.unzip} -q $src

packages/system/open-remote-ssh/version.json

@@ -0,0 +1,15 @@
+{
+  "schemaVersion": 1,
+  "variables": {
+    "version": "0.0.49",
+    "publisher": "jeanp413",
+    "name": "open-remote-ssh"
+  },
+  "sources": {
+    "vsix": {
+      "fetcher": "url",
+      "urlTemplate": "https://open-vsx.org/api/${publisher}/${name}/${version}/file/${publisher}.${name}-${version}.vsix",
+      "hash": "sha256-QfJnAAx+kO2iJ1EzWoO5HLogJKg3RiC3hg1/u2Jm6t4="
+    }
+  }
+}

packages/uboot/default.nix

@@ -19,11 +19,14 @@
 }@pkgs:
 
 let
-  defaultVersion = "2025.07";
+  inherit (lib.trivial) importJSON;
-  defaultSrc = fetchurl {
+  versionSpec = importJSON ./version.json;
-    url = "https://ftp.denx.de/pub/u-boot/u-boot-${defaultVersion}.tar.bz2";
+  versioning = import ../../lib/versioning.nix { inherit lib pkgs; };
-    hash = "sha256-D5M/bFpCaJW/MG6T5qxTxghw5LVM2lbZUhG+yZ5jvsc=";
+  selected = versioning.selectVariant versionSpec null null;
-  };
+  sources = versioning.mkAllSources selected;
+
+  defaultVersion = selected.variables.version;
+  defaultSrc = sources.uboot;
 
   # Dependencies for the tools need to be included as either native or cross,
   # depending on which we're building

packages/uboot/version.json

@@ -0,0 +1,13 @@
+{
+  "schemaVersion": 1,
+  "variables": {
+    "version": "2025.07"
+  },
+  "sources": {
+    "uboot": {
+      "fetcher": "url",
+      "urlTemplate": "https://ftp.denx.de/pub/u-boot/u-boot-${version}.tar.bz2",
+      "hash": "sha256-D5M/bFpCaJW/MG6T5qxTxghw5LVM2lbZUhG+yZ5jvsc="
+    }
+  }
+}

packages/uboot/versions.json

@@ -1,5 +0,0 @@
-{
-    "repo": "https://ftp.denx.de/pub/u-boot/u-boot-${defaultVersion}.tar.bz2",
-    "tag": "2025.07",
-    "hash": "sha256-D5M/bFpCaJW/MG6T5qxTxghw5LVM2lbZUhG+yZ5jvsc="
-}