21 files changed, 2044 insertions, 131 deletions

diff --git a/src/libexpr/attr-path.cc b/src/libexpr/attr-path.cc
index 06b472d8b..843585631 100644
--- a/src/libexpr/attr-path.cc
+++ b/src/libexpr/attr-path.cc
@@ -70,7 +70,7 @@ Value * findAlongAttrPath(EvalState & state, const string & attrPath,
 
             Bindings::iterator a = v->attrs->find(state.symbols.create(attr));
             if (a == v->attrs->end())
-                throw Error(format("attribute '%1%' in selection path '%2%' not found") % attr % attrPath);
+                throw AttrPathNotFound("attribute '%1%' in selection path '%2%' not found", attr, attrPath);
             v = &*a->value;
         }
 
@@ -82,7 +82,7 @@ Value * findAlongAttrPath(EvalState & state, const string & attrPath,
                     % attrPath % showType(*v));
 
             if (attrIndex >= v->listSize())
-                throw Error(format("list index %1% in selection path '%2%' is out of range") % attrIndex % attrPath);
+                throw AttrPathNotFound("list index %1% in selection path '%2%' is out of range", attrIndex, attrPath);
 
             v = v->listElems()[attrIndex];
         }
diff --git a/src/libexpr/attr-path.hh b/src/libexpr/attr-path.hh
index 716e5ba27..fcccc39c8 100644
--- a/src/libexpr/attr-path.hh
+++ b/src/libexpr/attr-path.hh
@@ -7,6 +7,8 @@
 
 namespace nix {
 
+MakeError(AttrPathNotFound, Error);
+
 Value * findAlongAttrPath(EvalState & state, const string & attrPath,
     Bindings & autoArgs, Value & vIn);
 
diff --git a/src/libexpr/attr-set.cc b/src/libexpr/attr-set.cc
index 0785897d2..b1d61a285 100644
--- a/src/libexpr/attr-set.cc
+++ b/src/libexpr/attr-set.cc
@@ -43,6 +43,12 @@ Value * EvalState::allocAttr(Value & vAttrs, const Symbol & name)
 }
 
 
+Value * EvalState::allocAttr(Value & vAttrs, const std::string & name)
+{
+    return allocAttr(vAttrs, symbols.create(name));
+}
+
+
 void Bindings::sort()
 {
     std::sort(begin(), end());
diff --git a/src/libexpr/common-eval-args.cc b/src/libexpr/common-eval-args.cc
index 13950ab8d..7c0d268bd 100644
--- a/src/libexpr/common-eval-args.cc
+++ b/src/libexpr/common-eval-args.cc
@@ -26,6 +26,22 @@ MixEvalArgs::MixEvalArgs()
         .description("add a path to the list of locations used to look up <...> file names")
         .label("path")
         .handler([&](std::string s) { searchPath.push_back(s); });
+
+    mkFlag()
+        .longName("impure")
+        .description("allow access to mutable paths and repositories")
+        .handler([&](std::vector<std::string> ss) {
+            evalSettings.pureEval = false;
+        });
+
+    mkFlag()
+      .longName("override-flake")
+      .labels({"original-ref", "resolved-ref"})
+      .description("override a flake registry value")
+      .arity(2)
+      .handler([&](std::vector<std::string> ss) {
+          registryOverrides.push_back(std::make_pair(ss[0], ss[1]));
+      });
 }
 
 Bindings * MixEvalArgs::getAutoArgs(EvalState & state)
diff --git a/src/libexpr/common-eval-args.hh b/src/libexpr/common-eval-args.hh
index be7fda783..54fb731de 100644
--- a/src/libexpr/common-eval-args.hh
+++ b/src/libexpr/common-eval-args.hh
@@ -16,6 +16,8 @@ struct MixEvalArgs : virtual Args
 
     Strings searchPath;
 
+    std::vector<std::pair<std::string, std::string>> registryOverrides;
+
 private:
 
     std::map<std::string, std::string> autoArgs;
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index dac32b6f5..852e8aa11 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -8,6 +8,7 @@
 #include "download.hh"
 #include "json.hh"
 #include "function-trace.hh"
+#include "flake/flake.hh"
 
 #include <algorithm>
 #include <chrono>
@@ -153,12 +154,12 @@ const Value *getPrimOp(const Value &v) {
 }
 
 
-string showType(const Value & v)
+string showType(ValueType type)
 {
-    switch (v.type) {
+    switch (type) {
         case tInt: return "an integer";
         case tBool: return "a boolean";
-        case tString: return v.string.context ? "a string with context" : "a string";
+        case tString: return "a string";
         case tPath: return "a path";
         case tNull: return "null";
         case tAttrs: return "a set";
@@ -167,14 +168,39 @@ string showType(const Value & v)
         case tApp: return "a function application";
         case tLambda: return "a function";
         case tBlackhole: return "a black hole";
+        case tPrimOp: return "a built-in function";
+        case tPrimOpApp: return "a partially applied built-in function";
+        case tExternal: return "an external value";
+        case tFloat: return "a float";
+    }
+    abort();
+}
+
+
+string showType(const Value & v)
+{
+    switch (v.type) {
+        case tString: return v.string.context ? "a string with context" : "a string";
         case tPrimOp:
             return fmt("the built-in function '%s'", string(v.primOp->name));
         case tPrimOpApp:
             return fmt("the partially applied built-in function '%s'", string(getPrimOp(v)->primOp->name));
         case tExternal: return v.external->showType();
-        case tFloat: return "a float";
+    default:
+        return showType(v.type);
     }
-    abort();
+}
+
+
+bool Value::isTrivial() const
+{
+    return
+        type != tApp
+        && type != tPrimOpApp
+        && (type != tThunk
+            || (dynamic_cast<ExprAttrs *>(thunk.expr)
+                && ((ExprAttrs *) thunk.expr)->dynamicAttrs.empty())
+            || dynamic_cast<ExprLambda *>(thunk.expr));
 }
 
 
@@ -315,6 +341,8 @@ EvalState::EvalState(const Strings & _searchPath, ref<Store> store)
     , sOutputHash(symbols.create("outputHash"))
     , sOutputHashAlgo(symbols.create("outputHashAlgo"))
     , sOutputHashMode(symbols.create("outputHashMode"))
+    , sDescription(symbols.create("description"))
+    , sSelf(symbols.create("self"))
     , repair(NoRepair)
     , store(store)
     , baseEnv(allocEnv(128))
@@ -463,14 +491,21 @@ Value * EvalState::addConstant(const string & name, Value & v)
 Value * EvalState::addPrimOp(const string & name,
     size_t arity, PrimOpFun primOp)
 {
+    auto name2 = string(name, 0, 2) == "__" ? string(name, 2) : name;
+    Symbol sym = symbols.create(name2);
+
+    /* Hack to make constants lazy: turn them into a application of
+       the primop to a dummy value. */
     if (arity == 0) {
+        auto vPrimOp = allocValue();
+        vPrimOp->type = tPrimOp;
+        vPrimOp->primOp = new PrimOp(primOp, 1, sym);
         Value v;
-        primOp(*this, noPos, nullptr, v);
+        mkApp(v, *vPrimOp, *vPrimOp);
         return addConstant(name, v);
     }
+
     Value * v = allocValue();
-    string name2 = string(name, 0, 2) == "__" ? string(name, 2) : name;
-    Symbol sym = symbols.create(name2);
     v->type = tPrimOp;
     v->primOp = new PrimOp(primOp, arity, sym);
     staticBaseEnv.vars[symbols.create(name)] = baseEnvDispl;
@@ -736,7 +771,7 @@ Value * ExprPath::maybeThunk(EvalState & state, Env & env)
 }
 
 
-void EvalState::evalFile(const Path & path_, Value & v)
+void EvalState::evalFile(const Path & path_, Value & v, bool mustBeTrivial)
 {
     auto path = checkSourcePath(path_);
 
@@ -765,6 +800,11 @@ void EvalState::evalFile(const Path & path_, Value & v)
     fileParseCache[path2] = e;
 
     try {
+        // Enforce that 'flake.nix' is a direct attrset, not a
+        // computation.
+        if (mustBeTrivial &&
+            !(dynamic_cast<ExprAttrs *>(e)))
+            throw Error("file '%s' must be an attribute set", path);
         eval(e, v);
     } catch (Error & e) {
         addErrorPrefix(e, "while evaluating the file '%1%':\n", path2);
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index cabc92d15..526d8b198 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -4,12 +4,12 @@
 #include "value.hh"
 #include "nixexpr.hh"
 #include "symbol-table.hh"
-#include "hash.hh"
 #include "config.hh"
 
 #include <map>
 #include <optional>
 #include <unordered_map>
+#include <mutex>
 
 
 namespace nix {
@@ -20,6 +20,10 @@ class EvalState;
 struct StorePath;
 enum RepairFlag : bool;
 
+namespace flake {
+struct FlakeRegistry;
+}
+
 
 typedef void (* PrimOpFun) (EvalState & state, const Pos & pos, Value * * args, Value & v);
 
@@ -63,6 +67,8 @@ typedef std::list<SearchPathElem> SearchPath;
 /* Initialise the Boehm GC, if applicable. */
 void initGC();
 
+typedef std::vector<std::pair<std::string, std::string>> RegistryOverrides;
+
 
 class EvalState
 {
@@ -73,7 +79,8 @@ public:
         sSystem, sOverrides, sOutputs, sOutputName, sIgnoreNulls,
         sFile, sLine, sColumn, sFunctor, sToString,
         sRight, sWrong, sStructuredAttrs, sBuilder, sArgs,
-        sOutputHash, sOutputHashAlgo, sOutputHashMode;
+        sOutputHash, sOutputHashAlgo, sOutputHashMode,
+        sDescription, sSelf;
     Symbol sDerivationNix;
 
     /* If set, force copying files to the Nix store even if they
@@ -88,6 +95,9 @@ public:
 
     const ref<Store> store;
 
+    RegistryOverrides registryOverrides;
+
+
 private:
     SrcToStore srcToStore;
 
@@ -147,8 +157,9 @@ public:
     Expr * parseStdin();
 
     /* Evaluate an expression read from the given file to normal
-       form. */
-    void evalFile(const Path & path, Value & v);
+       form. Optionally enforce that the top-level expression is
+       trivial (i.e. doesn't require arbitrary computation). */
+    void evalFile(const Path & path, Value & v, bool mustBeTrivial = false);
 
     void resetFileCache();
 
@@ -213,6 +224,8 @@ public:
        path.  Nothing is copied to the store. */
     Path coerceToPath(const Pos & pos, Value & v, PathSet & context);
 
+    void addRegistryOverrides(RegistryOverrides overrides) { registryOverrides = overrides; }
+
 public:
 
     /* The base environment, containing the builtin functions and
@@ -268,6 +281,7 @@ public:
     Env & allocEnv(size_t size);
 
     Value * allocAttr(Value & vAttrs, const Symbol & name);
+    Value * allocAttr(Value & vAttrs, const std::string & name);
 
     Bindings * allocBindings(size_t capacity);
 
@@ -314,10 +328,21 @@ private:
     friend struct ExprOpConcatLists;
     friend struct ExprSelect;
     friend void prim_getAttr(EvalState & state, const Pos & pos, Value * * args, Value & v);
+
+public:
+
+    const std::vector<std::shared_ptr<flake::FlakeRegistry>> getFlakeRegistries();
+
+    std::shared_ptr<flake::FlakeRegistry> getGlobalFlakeRegistry();
+
+private:
+    std::shared_ptr<flake::FlakeRegistry> _globalFlakeRegistry;
+    std::once_flag _globalFlakeRegistryInit;
 };
 
 
 /* Return a string representing the type of the value `v'. */
+string showType(ValueType type);
 string showType(const Value & v);
 
 /* Decode a context string ‘!<name>!<path>’ into a pair <path,
@@ -362,7 +387,16 @@ struct EvalSettings : Config
         "Prefixes of URIs that builtin functions such as fetchurl and fetchGit are allowed to fetch."};
 
     Setting<bool> traceFunctionCalls{this, false, "trace-function-calls",
-        "Emit log messages for each function entry and exit at the 'vomit' log level (-vvvv)"};
+        "Emit log messages for each function entry and exit at the 'vomit' log level (-vvvv)."};
+
+    Setting<std::string> flakeRegistry{this, "https://github.com/NixOS/flake-registry/raw/master/flake-registry.json", "flake-registry",
+        "Path or URI of the global flake registry."};
+
+    Setting<bool> allowDirty{this, true, "allow-dirty",
+        "Whether to allow dirty Git/Mercurial trees."};
+
+    Setting<bool> warnDirty{this, true, "warn-dirty",
+        "Whether to warn about dirty Git/Mercurial trees."};
 };
 
 extern EvalSettings evalSettings;
diff --git a/src/libexpr/flake/eval-cache.cc b/src/libexpr/flake/eval-cache.cc
new file mode 100644
index 000000000..8d01ef0fc
--- /dev/null
+++ b/src/libexpr/flake/eval-cache.cc
@@ -0,0 +1,116 @@
+#include "eval-cache.hh"
+#include "sqlite.hh"
+#include "eval.hh"
+
+#include <set>
+
+namespace nix::flake {
+
+static const char * schema = R"sql(
+
+create table if not exists Fingerprints (
+    fingerprint blob primary key not null,
+    timestamp   integer not null
+);
+
+create table if not exists Attributes (
+    fingerprint blob not null,
+    attrPath    text not null,
+    type        integer,
+    value       text,
+    primary key (fingerprint, attrPath),
+    foreign key (fingerprint) references Fingerprints(fingerprint) on delete cascade
+);
+)sql";
+
+struct EvalCache::State
+{
+    SQLite db;
+    SQLiteStmt insertFingerprint;
+    SQLiteStmt insertAttribute;
+    SQLiteStmt queryAttribute;
+    std::set<Fingerprint> fingerprints;
+};
+
+EvalCache::EvalCache()
+    : _state(std::make_unique<Sync<State>>())
+{
+    auto state(_state->lock());
+
+    Path dbPath = getCacheDir() + "/nix/eval-cache-v1.sqlite";
+    createDirs(dirOf(dbPath));
+
+    state->db = SQLite(dbPath);
+    state->db.isCache();
+    state->db.exec(schema);
+
+    state->insertFingerprint.create(state->db,
+        "insert or ignore into Fingerprints(fingerprint, timestamp) values (?, ?)");
+
+    state->insertAttribute.create(state->db,
+        "insert or replace into Attributes(fingerprint, attrPath, type, value) values (?, ?, ?, ?)");
+
+    state->queryAttribute.create(state->db,
+        "select type, value from Attributes where fingerprint = ? and attrPath = ?");
+}
+
+enum ValueType {
+    Derivation = 1,
+};
+
+void EvalCache::addDerivation(
+    const Fingerprint & fingerprint,
+    const std::string & attrPath,
+    const Derivation & drv)
+{
+    if (!evalSettings.pureEval) return;
+
+    auto state(_state->lock());
+
+    if (state->fingerprints.insert(fingerprint).second)
+        // FIXME: update timestamp
+        state->insertFingerprint.use()
+            (fingerprint.hash, fingerprint.hashSize)
+            (time(0)).exec();
+
+    state->insertAttribute.use()
+        (fingerprint.hash, fingerprint.hashSize)
+        (attrPath)
+        (ValueType::Derivation)
+        (std::string(drv.drvPath.to_string()) + " " + std::string(drv.outPath.to_string()) + " " + drv.outputName).exec();
+}
+
+std::optional<EvalCache::Derivation> EvalCache::getDerivation(
+    const Fingerprint & fingerprint,
+    const std::string & attrPath)
+{
+    if (!evalSettings.pureEval) return {};
+
+    auto state(_state->lock());
+
+    auto queryAttribute(state->queryAttribute.use()
+        (fingerprint.hash, fingerprint.hashSize)
+        (attrPath));
+    if (!queryAttribute.next()) return {};
+
+    // FIXME: handle negative results
+
+    auto type = (ValueType) queryAttribute.getInt(0);
+    auto s = queryAttribute.getStr(1);
+
+    if (type != ValueType::Derivation) return {};
+
+    auto ss = tokenizeString<std::vector<std::string>>(s, " ");
+
+    debug("evaluation cache hit for '%s'", attrPath);
+
+    return Derivation { StorePath::fromBaseName(ss[0]), StorePath::fromBaseName(ss[1]), ss[2] };
+}
+
+EvalCache & EvalCache::singleton()
+{
+    static std::unique_ptr<EvalCache> evalCache(new EvalCache());
+    return *evalCache;
+}
+
+}
diff --git a/src/libexpr/flake/eval-cache.hh b/src/libexpr/flake/eval-cache.hh
new file mode 100644
index 000000000..f81d48ba5
--- /dev/null
+++ b/src/libexpr/flake/eval-cache.hh
@@ -0,0 +1,40 @@
+#pragma once
+
+#include "sync.hh"
+#include "flake.hh"
+#include "path.hh"
+
+namespace nix { struct SQLite; struct SQLiteStmt; }
+
+namespace nix::flake {
+
+class EvalCache
+{
+    struct State;
+
+    std::unique_ptr<Sync<State>> _state;
+
+    EvalCache();
+
+public:
+
+    struct Derivation
+    {
+        StorePath drvPath;
+        StorePath outPath;
+        std::string outputName;
+    };
+
+    void addDerivation(
+        const Fingerprint & fingerprint,
+        const std::string & attrPath,
+        const Derivation & drv);
+
+    std::optional<Derivation> getDerivation(
+        const Fingerprint & fingerprint,
+        const std::string & attrPath);
+
+    static EvalCache & singleton();
+};
+
+}
diff --git a/src/libexpr/flake/flake.cc b/src/libexpr/flake/flake.cc
new file mode 100644
index 000000000..a644f6ad3
--- /dev/null
+++ b/src/libexpr/flake/flake.cc
@@ -0,0 +1,696 @@
+#include "flake.hh"
+#include "lockfile.hh"
+#include "primops.hh"
+#include "eval-inline.hh"
+#include "primops/fetchGit.hh"
+#include "download.hh"
+#include "args.hh"
+
+#include <iostream>
+#include <queue>
+#include <regex>
+#include <ctime>
+#include <iomanip>
+#include <nlohmann/json.hpp>
+
+namespace nix {
+
+using namespace flake;
+
+namespace flake {
+
+/* Read a registry. */
+std::shared_ptr<FlakeRegistry> readRegistry(const Path & path)
+{
+    auto registry = std::make_shared<FlakeRegistry>();
+
+    if (!pathExists(path))
+        return std::make_shared<FlakeRegistry>();
+
+    auto json = nlohmann::json::parse(readFile(path));
+
+    auto version = json.value("version", 0);
+    if (version != 1)
+        throw Error("flake registry '%s' has unsupported version %d", path, version);
+
+    auto flakes = json["flakes"];
+    for (auto i = flakes.begin(); i != flakes.end(); ++i) {
+        // FIXME: remove 'uri' soon.
+        auto url = i->value("url", i->value("uri", ""));
+        if (url.empty())
+            throw Error("flake registry '%s' lacks a 'url' attribute for entry '%s'",
+                path, i.key());
+        registry->entries.emplace(i.key(), url);
+    }
+
+    return registry;
+}
+
+/* Write a registry to a file. */
+void writeRegistry(const FlakeRegistry & registry, const Path & path)
+{
+    nlohmann::json json;
+    json["version"] = 1;
+    for (auto elem : registry.entries)
+        json["flakes"][elem.first.to_string()] = { {"url", elem.second.to_string()} };
+    createDirs(dirOf(path));
+    writeFile(path, json.dump(4)); // The '4' is the number of spaces used in the indentation in the json file.
+}
+
+Path getUserRegistryPath()
+{
+    return getHome() + "/.config/nix/registry.json";
+}
+
+std::shared_ptr<FlakeRegistry> getUserRegistry()
+{
+    return readRegistry(getUserRegistryPath());
+}
+
+std::shared_ptr<FlakeRegistry> getFlagRegistry(RegistryOverrides registryOverrides)
+{
+    auto flagRegistry = std::make_shared<FlakeRegistry>();
+    for (auto const & x : registryOverrides) {
+        flagRegistry->entries.insert_or_assign(FlakeRef(x.first), FlakeRef(x.second));
+    }
+    return flagRegistry;
+}
+
+static FlakeRef lookupFlake(EvalState & state, const FlakeRef & flakeRef, const Registries & registries,
+    std::vector<FlakeRef> pastSearches = {});
+
+FlakeRef updateFlakeRef(EvalState & state, const FlakeRef & newRef, const Registries & registries, std::vector<FlakeRef> pastSearches)
+{
+    std::string errorMsg = "found cycle in flake registries: ";
+    for (FlakeRef oldRef : pastSearches) {
+        errorMsg += oldRef.to_string();
+        if (oldRef == newRef)
+            throw Error(errorMsg);
+        errorMsg += " - ";
+    }
+    pastSearches.push_back(newRef);
+    return lookupFlake(state, newRef, registries, pastSearches);
+}
+
+static FlakeRef lookupFlake(EvalState & state, const FlakeRef & flakeRef, const Registries & registries,
+    std::vector<FlakeRef> pastSearches)
+{
+    for (std::shared_ptr<FlakeRegistry> registry : registries) {
+        auto i = registry->entries.find(flakeRef);
+        if (i != registry->entries.end()) {
+            auto newRef = i->second;
+            return updateFlakeRef(state, newRef, registries, pastSearches);
+        }
+
+        auto j = registry->entries.find(flakeRef.baseRef());
+        if (j != registry->entries.end()) {
+            auto newRef = j->second;
+            newRef.ref = flakeRef.ref;
+            newRef.rev = flakeRef.rev;
+            newRef.subdir = flakeRef.subdir;
+            return updateFlakeRef(state, newRef, registries, pastSearches);
+        }
+    }
+
+    if (!flakeRef.isDirect())
+        throw Error("could not resolve flake reference '%s'", flakeRef);
+
+    return flakeRef;
+}
+
+/* If 'allowLookup' is true, then resolve 'flakeRef' using the
+   registries. */
+static FlakeRef maybeLookupFlake(
+    EvalState & state,
+    const FlakeRef & flakeRef,
+    bool allowLookup)
+{
+    if (!flakeRef.isDirect()) {
+        if (allowLookup)
+            return lookupFlake(state, flakeRef, state.getFlakeRegistries());
+        else
+            throw Error("'%s' is an indirect flake reference, but registry lookups are not allowed", flakeRef);
+    } else
+        return flakeRef;
+}
+
+typedef std::vector<std::pair<FlakeRef, FlakeRef>> RefMap;
+
+static FlakeRef lookupInRefMap(
+    const RefMap & refMap,
+    const FlakeRef & flakeRef)
+{
+    // FIXME: inefficient.
+    for (auto & i : refMap) {
+        if (flakeRef.contains(i.first)) {
+            debug("mapping '%s' to previously seen input '%s' -> '%s",
+                flakeRef, i.first, i.second);
+            return i.second;
+        }
+    }
+
+    return flakeRef;
+}
+
+static SourceInfo fetchInput(EvalState & state, const FlakeRef & resolvedRef)
+{
+    assert(resolvedRef.isDirect());
+
+    auto doGit = [&](const GitInfo & gitInfo) {
+        FlakeRef ref(resolvedRef.baseRef());
+        ref.ref = gitInfo.ref;
+        ref.rev = gitInfo.rev;
+        SourceInfo info(ref);
+        info.storePath = gitInfo.storePath;
+        info.revCount = gitInfo.revCount;
+        info.narHash = state.store->queryPathInfo(state.store->parseStorePath(info.storePath))->narHash;
+        info.lastModified = gitInfo.lastModified;
+        return info;
+    };
+
+    // This only downloads one revision of the repo, not the entire history.
+    if (auto refData = std::get_if<FlakeRef::IsGitHub>(&resolvedRef.data)) {
+        return doGit(exportGitHub(state.store, refData->owner, refData->repo, resolvedRef.ref, resolvedRef.rev));
+    }
+
+    // This downloads the entire git history.
+    else if (auto refData = std::get_if<FlakeRef::IsGit>(&resolvedRef.data)) {
+        return doGit(exportGit(state.store, refData->uri, resolvedRef.ref, resolvedRef.rev, "source"));
+    }
+
+    else if (auto refData = std::get_if<FlakeRef::IsPath>(&resolvedRef.data)) {
+        if (!pathExists(refData->path + "/.git"))
+            throw Error("flake '%s' does not reference a Git repository", refData->path);
+        return doGit(exportGit(state.store, refData->path, resolvedRef.ref, resolvedRef.rev, "source"));
+    }
+
+    else abort();
+}
+
+static void expectType(EvalState & state, ValueType type,
+    Value & value, const Pos & pos)
+{
+    if (value.type == tThunk && value.isTrivial())
+        state.forceValue(value, pos);
+    if (value.type != type)
+        throw Error("expected %s but got %s at %s",
+            showType(type), showType(value.type), pos);
+}
+
+static Flake getFlake(EvalState & state, const FlakeRef & originalRef,
+    bool allowLookup, RefMap & refMap)
+{
+    auto flakeRef = lookupInRefMap(refMap,
+        maybeLookupFlake(state,
+            lookupInRefMap(refMap, originalRef), allowLookup));
+
+    SourceInfo sourceInfo = fetchInput(state, flakeRef);
+    debug("got flake source '%s' with flakeref %s", sourceInfo.storePath, sourceInfo.resolvedRef.to_string());
+
+    FlakeRef resolvedRef = sourceInfo.resolvedRef;
+
+    refMap.push_back({originalRef, resolvedRef});
+    refMap.push_back({flakeRef, resolvedRef});
+
+    state.store->parseStorePath(sourceInfo.storePath);
+
+    if (state.allowedPaths)
+        state.allowedPaths->insert(state.store->toRealPath(sourceInfo.storePath));
+
+    // Guard against symlink attacks.
+    Path flakeFile = canonPath(sourceInfo.storePath + "/" + resolvedRef.subdir + "/flake.nix");
+    Path realFlakeFile = state.store->toRealPath(flakeFile);
+    if (!isInDir(realFlakeFile, state.store->toRealPath(sourceInfo.storePath)))
+        throw Error("'flake.nix' file of flake '%s' escapes from '%s'", resolvedRef, sourceInfo.storePath);
+
+    Flake flake(originalRef, sourceInfo);
+
+    if (!pathExists(realFlakeFile))
+        throw Error("source tree referenced by '%s' does not contain a '%s/flake.nix' file", resolvedRef, resolvedRef.subdir);
+
+    Value vInfo;
+    state.evalFile(realFlakeFile, vInfo, true); // FIXME: symlink attack
+
+    expectType(state, tAttrs, vInfo, Pos(state.symbols.create(realFlakeFile), 0, 0));
+
+    auto sEdition = state.symbols.create("edition");
+    auto sEpoch = state.symbols.create("epoch"); // FIXME: remove soon
+
+    auto edition = vInfo.attrs->get(sEdition);
+    if (!edition)
+        edition = vInfo.attrs->get(sEpoch);
+
+    if (edition) {
+        expectType(state, tInt, *(**edition).value, *(**edition).pos);
+        flake.edition = (**edition).value->integer;
+        if (flake.edition > 201909)
+            throw Error("flake '%s' requires unsupported edition %d; please upgrade Nix", flakeRef, flake.edition);
+        if (flake.edition < 201909)
+            throw Error("flake '%s' has illegal edition %d", flakeRef, flake.edition);
+    } else
+        throw Error("flake '%s' lacks attribute 'edition'", flakeRef);
+
+    if (auto description = vInfo.attrs->get(state.sDescription)) {
+        expectType(state, tString, *(**description).value, *(**description).pos);
+        flake.description = (**description).value->string.s;
+    }
+
+    auto sInputs = state.symbols.create("inputs");
+    auto sUrl = state.symbols.create("url");
+    auto sUri = state.symbols.create("uri"); // FIXME: remove soon
+    auto sFlake = state.symbols.create("flake");
+
+    if (std::optional<Attr *> inputs = vInfo.attrs->get(sInputs)) {
+        expectType(state, tAttrs, *(**inputs).value, *(**inputs).pos);
+
+        for (Attr inputAttr : *(*(**inputs).value).attrs) {
+            expectType(state, tAttrs, *inputAttr.value, *inputAttr.pos);
+
+            FlakeInput input(FlakeRef(inputAttr.name));
+
+            for (Attr attr : *(inputAttr.value->attrs)) {
+                if (attr.name == sUrl || attr.name == sUri) {
+                    expectType(state, tString, *attr.value, *attr.pos);
+                    input.ref = std::string(attr.value->string.s);
+                } else if (attr.name == sFlake) {
+                    expectType(state, tBool, *attr.value, *attr.pos);
+                    input.isFlake = attr.value->boolean;
+                } else
+                    throw Error("flake input '%s' has an unsupported attribute '%s', at %s",
+                        inputAttr.name, attr.name, *attr.pos);
+            }
+
+            flake.inputs.emplace(inputAttr.name, input);
+        }
+    }
+
+    auto sOutputs = state.symbols.create("outputs");
+
+    if (auto outputs = vInfo.attrs->get(sOutputs)) {
+        expectType(state, tLambda, *(**outputs).value, *(**outputs).pos);
+        flake.vOutputs = (**outputs).value;
+
+        if (flake.vOutputs->lambda.fun->matchAttrs) {
+            for (auto & formal : flake.vOutputs->lambda.fun->formals->formals) {
+                if (formal.name != state.sSelf)
+                    flake.inputs.emplace(formal.name, FlakeInput(FlakeRef(formal.name)));
+            }
+        }
+
+    } else
+        throw Error("flake '%s' lacks attribute 'outputs'", flakeRef);
+
+    for (auto & attr : *vInfo.attrs) {
+        if (attr.name != sEdition &&
+            attr.name != sEpoch &&
+            attr.name != state.sDescription &&
+            attr.name != sInputs &&
+            attr.name != sOutputs)
+            throw Error("flake '%s' has an unsupported attribute '%s', at %s",
+                flakeRef, attr.name, *attr.pos);
+    }
+
+    return flake;
+}
+
+Flake getFlake(EvalState & state, const FlakeRef & originalRef, bool allowLookup)
+{
+    RefMap refMap;
+    return getFlake(state, originalRef, allowLookup, refMap);
+}
+
+static SourceInfo getNonFlake(EvalState & state, const FlakeRef & originalRef,
+    bool allowLookup, RefMap & refMap)
+{
+    auto flakeRef = lookupInRefMap(refMap,
+        maybeLookupFlake(state,
+            lookupInRefMap(refMap, originalRef), allowLookup));
+
+    auto sourceInfo = fetchInput(state, flakeRef);
+    debug("got non-flake source '%s' with flakeref %s", sourceInfo.storePath, sourceInfo.resolvedRef.to_string());
+
+    FlakeRef resolvedRef = sourceInfo.resolvedRef;
+
+    refMap.push_back({originalRef, resolvedRef});
+    refMap.push_back({flakeRef, resolvedRef});
+
+    state.store->parseStorePath(sourceInfo.storePath);
+
+    if (state.allowedPaths)
+        state.allowedPaths->insert(sourceInfo.storePath);
+
+    return sourceInfo;
+}
+
+bool allowedToWrite(HandleLockFile handle)
+{
+    return handle == UpdateLockFile || handle == RecreateLockFile;
+}
+
+bool recreateLockFile(HandleLockFile handle)
+{
+    return handle == RecreateLockFile || handle == UseNewLockFile;
+}
+
+bool allowedToUseRegistries(HandleLockFile handle, bool isTopRef)
+{
+    if (handle == AllPure) return false;
+    else if (handle == TopRefUsesRegistries) return isTopRef;
+    else if (handle == UpdateLockFile) return true;
+    else if (handle == UseUpdatedLockFile) return true;
+    else if (handle == RecreateLockFile) return true;
+    else if (handle == UseNewLockFile) return true;
+    else assert(false);
+}
+
+/* Given a flakeref and its subtree of the lockfile, return an updated
+   subtree of the lockfile. That is, if the 'flake.nix' of the
+   referenced flake has inputs that don't have a corresponding entry
+   in the lockfile, they're added to the lockfile; conversely, any
+   lockfile entries that don't have a corresponding entry in flake.nix
+   are removed.
+
+   Note that this is lazy: we only recursively fetch inputs that are
+   not in the lockfile yet. */
+static std::pair<Flake, LockedInput> updateLocks(
+    RefMap & refMap,
+    const std::string & inputPath,
+    EvalState & state,
+    const Flake & flake,
+    HandleLockFile handleLockFile,
+    const LockedInputs & oldEntry,
+    bool topRef)
+{
+    LockedInput newEntry(
+        flake.sourceInfo.resolvedRef,
+        flake.originalRef,
+        flake.sourceInfo.narHash);
+
+    std::vector<std::function<void()>> postponed;
+
+    for (auto & [id, input] : flake.inputs) {
+        auto inputPath2 = (inputPath.empty() ? "" : inputPath + "/") + id;
+        auto i = oldEntry.inputs.find(id);
+        if (i != oldEntry.inputs.end() && i->second.originalRef == input.ref) {
+            newEntry.inputs.insert_or_assign(id, i->second);
+        } else {
+            if (handleLockFile == AllPure || handleLockFile == TopRefUsesRegistries)
+                throw Error("cannot update flake input '%s' in pure mode", id);
+
+            auto warn = [&](const SourceInfo & sourceInfo) {
+                if (i == oldEntry.inputs.end())
+                    printInfo("mapped flake input '%s' to '%s'",
+                        inputPath2, sourceInfo.resolvedRef);
+                else
+                    printMsg(lvlWarn, "updated flake input '%s' from '%s' to '%s'",
+                        inputPath2, i->second.originalRef, sourceInfo.resolvedRef);
+            };
+
+            if (input.isFlake) {
+                auto actualInput = getFlake(state, input.ref,
+                    allowedToUseRegistries(handleLockFile, false), refMap);
+                warn(actualInput.sourceInfo);
+                postponed.push_back([&, id{id}, inputPath2, actualInput]() {
+                    newEntry.inputs.insert_or_assign(id,
+                        updateLocks(refMap, inputPath2, state, actualInput, handleLockFile, {}, false).second);
+                });
+            } else {
+                auto sourceInfo = getNonFlake(state, input.ref,
+                    allowedToUseRegistries(handleLockFile, false), refMap);
+                warn(sourceInfo);
+                newEntry.inputs.insert_or_assign(id,
+                    LockedInput(sourceInfo.resolvedRef, input.ref, sourceInfo.narHash));
+            }
+        }
+    }
+
+    for (auto & f : postponed) f();
+
+    return {flake, newEntry};
+}
+
+/* Compute an in-memory lockfile for the specified top-level flake,
+   and optionally write it to file, it the flake is writable. */
+ResolvedFlake resolveFlake(EvalState & state, const FlakeRef & topRef, HandleLockFile handleLockFile)
+{
+    settings.requireExperimentalFeature("flakes");
+
+    auto flake = getFlake(state, topRef,
+        allowedToUseRegistries(handleLockFile, true));
+
+    LockFile oldLockFile;
+
+    if (!recreateLockFile(handleLockFile)) {
+        // If recreateLockFile, start with an empty lockfile
+        // FIXME: symlink attack
+        oldLockFile = LockFile::read(
+            state.store->toRealPath(flake.sourceInfo.storePath)
+            + "/" + flake.sourceInfo.resolvedRef.subdir + "/flake.lock");
+    }
+
+    debug("old lock file: %s", oldLockFile);
+
+    RefMap refMap;
+
+    LockFile lockFile(updateLocks(
+            refMap, "", state, flake, handleLockFile, oldLockFile, true).second);
+
+    debug("new lock file: %s", lockFile);
+
+    if (!(lockFile == oldLockFile)) {
+        if (allowedToWrite(handleLockFile)) {
+            if (auto refData = std::get_if<FlakeRef::IsPath>(&topRef.data)) {
+                if (lockFile.isDirty()) {
+                    if (evalSettings.warnDirty)
+                        warn("will not write lock file of flake '%s' because it has a dirty input", topRef);
+                } else {
+                    lockFile.write(refData->path + (topRef.subdir == "" ? "" : "/" + topRef.subdir) + "/flake.lock");
+
+                    // Hack: Make sure that flake.lock is visible to Git, so it ends up in the Nix store.
+                    runProgram("git", true,
+                        { "-C", refData->path, "add",
+                          "--force",
+                          "--intent-to-add",
+                          (topRef.subdir == "" ? "" : topRef.subdir + "/") + "flake.lock" });
+                }
+            } else
+                warn("cannot write lock file of remote flake '%s'", topRef);
+        } else if (handleLockFile != AllPure && handleLockFile != TopRefUsesRegistries)
+            warn("using updated lock file without writing it to file");
+    }
+
+    return ResolvedFlake(std::move(flake), std::move(lockFile));
+}
+
+void updateLockFile(EvalState & state, const FlakeRef & flakeRef, bool recreateLockFile)
+{
+    resolveFlake(state, flakeRef, recreateLockFile ? RecreateLockFile : UpdateLockFile);
+}
+
+static void emitSourceInfoAttrs(EvalState & state, const SourceInfo & sourceInfo, Value & vAttrs)
+{
+    auto & path = sourceInfo.storePath;
+    assert(state.store->isValidPath(state.store->parseStorePath(path)));
+    mkString(*state.allocAttr(vAttrs, state.sOutPath), path, {path});
+
+    if (sourceInfo.resolvedRef.rev) {
+        mkString(*state.allocAttr(vAttrs, state.symbols.create("rev")),
+            sourceInfo.resolvedRef.rev->gitRev());
+        mkString(*state.allocAttr(vAttrs, state.symbols.create("shortRev")),
+            sourceInfo.resolvedRef.rev->gitShortRev());
+    }
+
+    if (sourceInfo.revCount)
+        mkInt(*state.allocAttr(vAttrs, state.symbols.create("revCount")), *sourceInfo.revCount);
+
+    if (sourceInfo.lastModified)
+        mkString(*state.allocAttr(vAttrs, state.symbols.create("lastModified")),
+            fmt("%s",
+                std::put_time(std::gmtime(&*sourceInfo.lastModified), "%Y%m%d%H%M%S")));
+}
+
+struct LazyInput
+{
+    bool isFlake;
+    LockedInput lockedInput;
+};
+
+/* Helper primop to make callFlake (below) fetch/call its inputs
+   lazily. Note that this primop cannot be called by user code since
+   it doesn't appear in 'builtins'. */
+static void prim_callFlake(EvalState & state, const Pos & pos, Value * * args, Value & v)
+{
+    auto lazyInput = (LazyInput *) args[0]->attrs;
+
+    assert(lazyInput->lockedInput.ref.isImmutable());
+
+    if (lazyInput->isFlake) {
+        auto flake = getFlake(state, lazyInput->lockedInput.ref, false);
+
+        if (flake.sourceInfo.narHash != lazyInput->lockedInput.narHash)
+            throw Error("the content hash of flake '%s' doesn't match the hash recorded in the referring lockfile",
+                lazyInput->lockedInput.ref);
+
+        callFlake(state, flake, lazyInput->lockedInput, v);
+    } else {
+        RefMap refMap;
+        auto sourceInfo = getNonFlake(state, lazyInput->lockedInput.ref, false, refMap);
+
+        if (sourceInfo.narHash != lazyInput->lockedInput.narHash)
+            throw Error("the content hash of repository '%s' doesn't match the hash recorded in the referring lockfile",
+                lazyInput->lockedInput.ref);
+
+        state.mkAttrs(v, 8);
+
+        assert(state.store->isValidPath(state.store->parseStorePath(sourceInfo.storePath)));
+
+        mkString(*state.allocAttr(v, state.sOutPath),
+            sourceInfo.storePath, {sourceInfo.storePath});
+
+        emitSourceInfoAttrs(state, sourceInfo, v);
+
+        v.attrs->sort();
+    }
+}
+
+void callFlake(EvalState & state,
+    const Flake & flake,
+    const LockedInputs & lockedInputs,
+    Value & vResFinal)
+{
+    auto & vRes = *state.allocValue();
+    auto & vInputs = *state.allocValue();
+
+    state.mkAttrs(vInputs, flake.inputs.size() + 1);
+
+    for (auto & [inputId, input] : flake.inputs) {
+        auto vFlake = state.allocAttr(vInputs, inputId);
+        auto vPrimOp = state.allocValue();
+        static auto primOp = new PrimOp(prim_callFlake, 1, state.symbols.create("callFlake"));
+        vPrimOp->type = tPrimOp;
+        vPrimOp->primOp = primOp;
+        auto vArg = state.allocValue();
+        vArg->type = tNull;
+        auto lockedInput = lockedInputs.inputs.find(inputId);
+        assert(lockedInput != lockedInputs.inputs.end());
+        // FIXME: leak
+        vArg->attrs = (Bindings *) new LazyInput{input.isFlake, lockedInput->second};
+        mkApp(*vFlake, *vPrimOp, *vArg);
+    }
+
+    auto & vSourceInfo = *state.allocValue();
+    state.mkAttrs(vSourceInfo, 8);
+    emitSourceInfoAttrs(state, flake.sourceInfo, vSourceInfo);
+    vSourceInfo.attrs->sort();
+
+    vInputs.attrs->push_back(Attr(state.sSelf, &vRes));
+
+    vInputs.attrs->sort();
+
+    /* For convenience, put the outputs directly in the result, so you
+       can refer to an output of an input as 'inputs.foo.bar' rather
+       than 'inputs.foo.outputs.bar'. */
+    auto vCall = *state.allocValue();
+    state.eval(state.parseExprFromString(
+            "outputsFun: inputs: sourceInfo: let outputs = outputsFun inputs; in "
+            "outputs // sourceInfo // { inherit inputs; inherit outputs; inherit sourceInfo; }", "/"), vCall);
+
+    auto vCall2 = *state.allocValue();
+    auto vCall3 = *state.allocValue();
+    state.callFunction(vCall, *flake.vOutputs, vCall2, noPos);
+    state.callFunction(vCall2, vInputs, vCall3, noPos);
+    state.callFunction(vCall3, vSourceInfo, vRes, noPos);
+
+    vResFinal = vRes;
+}
+
+void callFlake(EvalState & state,
+    const ResolvedFlake & resFlake,
+    Value & v)
+{
+    callFlake(state, resFlake.flake, resFlake.lockFile, v);
+}
+
+// This function is exposed to be used in nix files.
+static void prim_getFlake(EvalState & state, const Pos & pos, Value * * args, Value & v)
+{
+    callFlake(state, resolveFlake(state, state.forceStringNoCtx(*args[0], pos),
+            evalSettings.pureEval ? AllPure : UseUpdatedLockFile), v);
+}
+
+static RegisterPrimOp r2("getFlake", 1, prim_getFlake);
+
+void gitCloneFlake(FlakeRef flakeRef, EvalState & state, Registries registries, const Path & destDir)
+{
+    flakeRef = lookupFlake(state, flakeRef, registries);
+
+    std::string uri;
+
+    Strings args = {"clone"};
+
+    if (auto refData = std::get_if<FlakeRef::IsGitHub>(&flakeRef.data)) {
+        uri = "git@github.com:" + refData->owner + "/" + refData->repo + ".git";
+        args.push_back(uri);
+        if (flakeRef.ref) {
+            args.push_back("--branch");
+            args.push_back(*flakeRef.ref);
+        }
+    } else if (auto refData = std::get_if<FlakeRef::IsGit>(&flakeRef.data)) {
+        args.push_back(refData->uri);
+        if (flakeRef.ref) {
+            args.push_back("--branch");
+            args.push_back(*flakeRef.ref);
+        }
+    }
+
+    if (destDir != "")
+        args.push_back(destDir);
+
+    runProgram("git", true, args);
+}
+
+}
+
+std::shared_ptr<flake::FlakeRegistry> EvalState::getGlobalFlakeRegistry()
+{
+    std::call_once(_globalFlakeRegistryInit, [&]() {
+        auto path = evalSettings.flakeRegistry;
+
+        if (!hasPrefix(path, "/")) {
+            CachedDownloadRequest request(evalSettings.flakeRegistry);
+            request.name = "flake-registry.json";
+            request.gcRoot = true;
+            path = getDownloader()->downloadCached(store, request).path;
+        }
+
+        _globalFlakeRegistry = readRegistry(path);
+    });
+
+    return _globalFlakeRegistry;
+}
+
+// This always returns a vector with flakeReg, userReg, globalReg.
+// If one of them doesn't exist, the registry is left empty but does exist.
+const Registries EvalState::getFlakeRegistries()
+{
+    Registries registries;
+    registries.push_back(getFlagRegistry(registryOverrides));
+    registries.push_back(getUserRegistry());
+    registries.push_back(getGlobalFlakeRegistry());
+    return registries;
+}
+
+Fingerprint ResolvedFlake::getFingerprint() const
+{
+    // FIXME: as an optimization, if the flake contains a lock file
+    // and we haven't changed it, then it's sufficient to use
+    // flake.sourceInfo.storePath for the fingerprint.
+    return hashString(htSHA256,
+        fmt("%s;%d;%d;%s",
+            flake.sourceInfo.storePath,
+            flake.sourceInfo.revCount.value_or(0),
+            flake.sourceInfo.lastModified.value_or(0),
+            lockFile));
+}
+
+}
diff --git a/src/libexpr/flake/flake.hh b/src/libexpr/flake/flake.hh
new file mode 100644
index 000000000..63d848889
--- /dev/null
+++ b/src/libexpr/flake/flake.hh
@@ -0,0 +1,114 @@
+#pragma once
+
+#include "types.hh"
+#include "flakeref.hh"
+#include "lockfile.hh"
+
+namespace nix {
+
+struct Value;
+class EvalState;
+
+namespace flake {
+
+static const size_t FLAG_REGISTRY = 0;
+static const size_t USER_REGISTRY = 1;
+static const size_t GLOBAL_REGISTRY = 2;
+
+struct FlakeRegistry
+{
+    std::map<FlakeRef, FlakeRef> entries;
+};
+
+typedef std::vector<std::shared_ptr<FlakeRegistry>> Registries;
+
+std::shared_ptr<FlakeRegistry> readRegistry(const Path &);
+
+void writeRegistry(const FlakeRegistry &, const Path &);
+
+Path getUserRegistryPath();
+
+enum HandleLockFile : unsigned int
+    { AllPure // Everything is handled 100% purely
+    , TopRefUsesRegistries // The top FlakeRef uses the registries, apart from that, everything happens 100% purely
+    , UpdateLockFile // Update the existing lockfile and write it to file
+    , UseUpdatedLockFile // `UpdateLockFile` without writing to file
+    , RecreateLockFile // Recreate the lockfile from scratch and write it to file
+    , UseNewLockFile // `RecreateLockFile` without writing to file
+    };
+
+struct SourceInfo
+{
+    // Immutable flakeref that this source tree was obtained from.
+    FlakeRef resolvedRef;
+
+    Path storePath;
+
+    // Number of ancestors of the most recent commit.
+    std::optional<uint64_t> revCount;
+
+    // NAR hash of the store path.
+    Hash narHash;
+
+    // A stable timestamp of this source tree. For Git and GitHub
+    // flakes, the commit date (not author date!) of the most recent
+    // commit.
+    std::optional<time_t> lastModified;
+
+    SourceInfo(const FlakeRef & resolvRef) : resolvedRef(resolvRef) {};
+};
+
+struct FlakeInput
+{
+    FlakeRef ref;
+    bool isFlake = true;
+    FlakeInput(const FlakeRef & ref) : ref(ref) {};
+};
+
+struct Flake
+{
+    FlakeRef originalRef;
+    std::string description;
+    SourceInfo sourceInfo;
+    std::map<FlakeId, FlakeInput> inputs;
+    Value * vOutputs; // FIXME: gc
+    unsigned int edition;
+
+    Flake(const FlakeRef & origRef, const SourceInfo & sourceInfo)
+        : originalRef(origRef), sourceInfo(sourceInfo) {};
+};
+
+Flake getFlake(EvalState & state, const FlakeRef & flakeRef, bool allowLookup);
+
+/* Fingerprint of a locked flake; used as a cache key. */
+typedef Hash Fingerprint;
+
+struct ResolvedFlake
+{
+    Flake flake;
+    LockFile lockFile;
+
+    ResolvedFlake(Flake && flake, LockFile && lockFile)
+        : flake(flake), lockFile(lockFile) {}
+
+    Fingerprint getFingerprint() const;
+};
+
+ResolvedFlake resolveFlake(EvalState &, const FlakeRef &, HandleLockFile);
+
+void callFlake(EvalState & state,
+    const Flake & flake,
+    const LockedInputs & inputs,
+    Value & v);
+
+void callFlake(EvalState & state,
+    const ResolvedFlake & resFlake,
+    Value & v);
+
+void updateLockFile(EvalState &, const FlakeRef & flakeRef, bool recreateLockFile);
+
+void gitCloneFlake(FlakeRef flakeRef, EvalState &, Registries, const Path & destDir);
+
+}
+
+}
diff --git a/src/libexpr/flake/flakeref.cc b/src/libexpr/flake/flakeref.cc
new file mode 100644
index 000000000..ff7c725cb
--- /dev/null
+++ b/src/libexpr/flake/flakeref.cc
@@ -0,0 +1,285 @@
+#include "flakeref.hh"
+#include "store-api.hh"
+
+#include <regex>
+
+namespace nix {
+
+// A Git ref (i.e. branch or tag name).
+const static std::string refRegex = "[a-zA-Z0-9][a-zA-Z0-9_.-]*"; // FIXME: check
+
+// A Git revision (a SHA-1 commit hash).
+const static std::string revRegexS = "[0-9a-fA-F]{40}";
+std::regex revRegex(revRegexS, std::regex::ECMAScript);
+
+// A Git ref or revision.
+const static std::string revOrRefRegex = "(?:(" + revRegexS + ")|(" + refRegex + "))";
+
+// A rev ("e72daba8250068216d79d2aeef40d4d95aff6666"), or a ref
+// optionally followed by a rev (e.g. "master" or
+// "master/e72daba8250068216d79d2aeef40d4d95aff6666").
+const static std::string refAndOrRevRegex = "(?:(" + revRegexS + ")|(?:(" + refRegex + ")(?:/(" + revRegexS + "))?))";
+
+const static std::string flakeId = "[a-zA-Z][a-zA-Z0-9_-]*";
+
+// GitHub references.
+const static std::string ownerRegex = "[a-zA-Z][a-zA-Z0-9_-]*";
+const static std::string repoRegex = "[a-zA-Z][a-zA-Z0-9_-]*";
+
+// URI stuff.
+const static std::string schemeRegex = "[a-z+]+";
+const static std::string authorityRegex = "[a-zA-Z0-9._~-]*";
+const static std::string segmentRegex = "[a-zA-Z0-9._~-]+";
+const static std::string pathRegex = "/?" + segmentRegex + "(?:/" + segmentRegex + ")*";
+
+// 'dir' path elements cannot start with a '.'. We also reject
+// potentially dangerous characters like ';'.
+const static std::string subDirElemRegex = "(?:[a-zA-Z0-9_-]+[a-zA-Z0-9._-]*)";
+const static std::string subDirRegex = subDirElemRegex + "(?:/" + subDirElemRegex + ")*";
+
+
+FlakeRef::FlakeRef(const std::string & uri_, bool allowRelative)
+{
+    // FIXME: could combine this into one regex.
+
+    static std::regex flakeRegex(
+        "(?:flake:)?(" + flakeId + ")(?:/(?:" + refAndOrRevRegex + "))?",
+        std::regex::ECMAScript);
+
+    static std::regex githubRegex(
+        "github:(" + ownerRegex + ")/(" + repoRegex + ")(?:/" + revOrRefRegex + ")?",
+        std::regex::ECMAScript);
+
+    static std::regex uriRegex(
+        "((" + schemeRegex + "):" +
+        "(?://(" + authorityRegex + "))?" +
+        "(" + pathRegex + "))",
+        std::regex::ECMAScript);
+
+    static std::regex refRegex2(refRegex, std::regex::ECMAScript);
+
+    static std::regex subDirRegex2(subDirRegex, std::regex::ECMAScript);
+
+    auto [uri2, params] = splitUriAndParams(uri_);
+    std::string uri(uri2);
+
+    auto handleSubdir = [&](const std::string & name, const std::string & value) {
+        if (name == "dir") {
+            if (value != "" && !std::regex_match(value, subDirRegex2))
+                throw BadFlakeRef("flake '%s' has invalid subdirectory '%s'", uri, value);
+            subdir = value;
+            return true;
+        } else
+            return false;
+    };
+
+    auto handleGitParams = [&](const std::string & name, const std::string & value) {
+        if (name == "rev") {
+            if (!std::regex_match(value, revRegex))
+                throw BadFlakeRef("invalid Git revision '%s'", value);
+            rev = Hash(value, htSHA1);
+        } else if (name == "ref") {
+            if (!std::regex_match(value, refRegex2))
+                throw BadFlakeRef("invalid Git ref '%s'", value);
+            ref = value;
+        } else if (handleSubdir(name, value))
+            ;
+        else return false;
+        return true;
+    };
+
+    std::smatch match;
+    if (std::regex_match(uri, match, flakeRegex)) {
+        IsId d;
+        d.id = match[1];
+        if (match[2].matched)
+            rev = Hash(match[2], htSHA1);
+        else if (match[3].matched) {
+            ref = match[3];
+            if (match[4].matched)
+                rev = Hash(match[4], htSHA1);
+        }
+        data = d;
+    }
+
+    else if (std::regex_match(uri, match, githubRegex)) {
+        IsGitHub d;
+        d.owner = match[1];
+        d.repo = match[2];
+        if (match[3].matched)
+            rev = Hash(match[3], htSHA1);
+        else if (match[4].matched) {
+            ref = match[4];
+        }
+        for (auto & param : params) {
+            if (handleSubdir(param.first, param.second))
+                ;
+            else
+                throw BadFlakeRef("invalid Git flakeref parameter '%s', in '%s'", param.first, uri);
+        }
+        data = d;
+    }
+
+    else if (std::regex_match(uri, match, uriRegex)) {
+        auto & scheme = match[2];
+        if (scheme == "git" ||
+            scheme == "git+http" ||
+            scheme == "git+https" ||
+            scheme == "git+ssh" ||
+            scheme == "git+file" ||
+            scheme == "file")
+        {
+            IsGit d;
+            d.uri = match[1];
+            for (auto & param : params) {
+                if (handleGitParams(param.first, param.second))
+                    ;
+                else
+                    // FIXME: should probably pass through unknown parameters
+                    throw BadFlakeRef("invalid Git flakeref parameter '%s', in '%s'", param.first, uri);
+            }
+            if (rev && !ref)
+                throw BadFlakeRef("flake URI '%s' lacks a Git ref", uri);
+            data = d;
+        } else
+            throw BadFlakeRef("unsupported URI scheme '%s' in flake reference '%s'", scheme, uri);
+    }
+
+    else if ((hasPrefix(uri, "/") || (allowRelative && (hasPrefix(uri, "./") || hasPrefix(uri, "../") || uri == ".")))
+        && uri.find(':') == std::string::npos)
+    {
+        IsPath d;
+        if (allowRelative) {
+            d.path = absPath(uri);
+            try {
+                if (!S_ISDIR(lstat(d.path).st_mode))
+                    throw MissingFlake("path '%s' is not a flake (sub)directory", d.path);
+            } catch (SysError & e) {
+                if (e.errNo == ENOENT || e.errNo == EISDIR)
+                    throw MissingFlake("flake '%s' does not exist", d.path);
+                throw;
+            }
+            while (true) {
+                if (pathExists(d.path + "/.git")) break;
+                subdir = std::string(baseNameOf(d.path)) + (subdir.empty() ? "" : "/" + subdir);
+                d.path = dirOf(d.path);
+                if (d.path == "/")
+                    throw MissingFlake("path '%s' is not a flake (because it does not reference a Git repository)", uri);
+            }
+        } else
+            d.path = canonPath(uri);
+        data = d;
+        for (auto & param : params) {
+            if (handleGitParams(param.first, param.second))
+                ;
+            else
+                throw BadFlakeRef("invalid Git flakeref parameter '%s', in '%s'", param.first, uri);
+        }
+    }
+
+    else
+        throw BadFlakeRef("'%s' is not a valid flake reference", uri);
+}
+
+std::string FlakeRef::to_string() const
+{
+    std::string string;
+    bool first = true;
+
+    auto addParam =
+        [&](const std::string & name, std::string value) {
+            string += first ? '?' : '&';
+            first = false;
+            string += name;
+            string += '=';
+            string += value; // FIXME: escaping
+        };
+
+    if (auto refData = std::get_if<FlakeRef::IsId>(&data)) {
+        string = refData->id;
+        if (ref) string += '/' + *ref;
+        if (rev) string += '/' + rev->gitRev();
+    }
+
+    else if (auto refData = std::get_if<FlakeRef::IsPath>(&data)) {
+        string = refData->path;
+        if (ref) addParam("ref", *ref);
+        if (rev) addParam("rev", rev->gitRev());
+        if (subdir != "") addParam("dir", subdir);
+    }
+
+    else if (auto refData = std::get_if<FlakeRef::IsGitHub>(&data)) {
+        assert(!(ref && rev));
+        string = "github:" + refData->owner + "/" + refData->repo;
+        if (ref) { string += '/'; string += *ref; }
+        if (rev) { string += '/'; string += rev->gitRev(); }
+        if (subdir != "") addParam("dir", subdir);
+    }
+
+    else if (auto refData = std::get_if<FlakeRef::IsGit>(&data)) {
+        assert(!rev || ref);
+        string = refData->uri;
+
+        if (ref) {
+            addParam("ref", *ref);
+            if (rev)
+                addParam("rev", rev->gitRev());
+        }
+
+        if (subdir != "") addParam("dir", subdir);
+    }
+
+    else abort();
+
+    assert(FlakeRef(string) == *this);
+
+    return string;
+}
+
+std::ostream & operator << (std::ostream & str, const FlakeRef & flakeRef)
+{
+    str << flakeRef.to_string();
+    return str;
+}
+
+bool FlakeRef::isImmutable() const
+{
+    return (bool) rev;
+}
+
+FlakeRef FlakeRef::baseRef() const // Removes the ref and rev from a FlakeRef.
+{
+    FlakeRef result(*this);
+    result.ref = std::nullopt;
+    result.rev = std::nullopt;
+    return result;
+}
+
+bool FlakeRef::contains(const FlakeRef & other) const
+{
+    if (!(data == other.data))
+        return false;
+
+    if (ref && ref != other.ref)
+        return false;
+
+    if (rev && rev != other.rev)
+        return false;
+
+    if (subdir != other.subdir)
+        return false;
+
+    return true;
+}
+
+std::optional<FlakeRef> parseFlakeRef(
+    const std::string & uri, bool allowRelative)
+{
+    try {
+        return FlakeRef(uri, allowRelative);
+    } catch (BadFlakeRef & e) {
+        return {};
+    }
+}
+
+}
diff --git a/src/libexpr/flake/flakeref.hh b/src/libexpr/flake/flakeref.hh
new file mode 100644
index 000000000..addf5449f
--- /dev/null
+++ b/src/libexpr/flake/flakeref.hh
@@ -0,0 +1,200 @@
+#pragma once
+
+#include "types.hh"
+#include "hash.hh"
+
+#include <variant>
+
+namespace nix {
+
+/* Flake references are a URI-like syntax to specify a flake.
+
+   Examples:
+
+   * <flake-id>(/rev-or-ref(/rev)?)?
+
+     Look up a flake by ID in the flake lock file or in the flake
+     registry. These must specify an actual location for the flake
+     using the formats listed below. Note that in pure evaluation
+     mode, the flake registry is empty.
+
+     Optionally, the rev or ref from the dereferenced flake can be
+     overriden. For example,
+
+       nixpkgs/19.09
+
+     uses the "19.09" branch of the nixpkgs' flake GitHub repository,
+     while
+
+       nixpkgs/98a2a5b5370c1e2092d09cb38b9dcff6d98a109f
+
+     uses the specified revision. For Git (rather than GitHub)
+     repositories, both the rev and ref must be given, e.g.
+
+       nixpkgs/19.09/98a2a5b5370c1e2092d09cb38b9dcff6d98a109f
+
+   * github:<owner>/<repo>(/<rev-or-ref>)?
+
+     A repository on GitHub. These differ from Git references in that
+     they're downloaded in a efficient way (via the tarball mechanism)
+     and that they support downloading a specific revision without
+     specifying a branch. <rev-or-ref> is either a commit hash ("rev")
+     or a branch or tag name ("ref"). The default is: "master" if none
+     is specified. Note that in pure evaluation mode, a commit hash
+     must be used.
+
+     Flakes fetched in this manner expose "rev" and "lastModified"
+     attributes, but not "revCount".
+
+     Examples:
+
+       github:edolstra/dwarffs
+       github:edolstra/dwarffs/unstable
+       github:edolstra/dwarffs/41c0c1bf292ea3ac3858ff393b49ca1123dbd553
+
+   * git+https://<server>/<path>(\?attr(&attr)*)?
+     git+ssh://<server>/<path>(\?attr(&attr)*)?
+     git://<server>/<path>(\?attr(&attr)*)?
+     file:///<path>(\?attr(&attr)*)?
+
+     where 'attr' is one of:
+       rev=<rev>
+       ref=<ref>
+
+     A Git repository fetched through https. The default for "ref" is
+     "master".
+
+     Examples:
+
+       git+https://example.org/my/repo.git
+       git+https://example.org/my/repo.git?ref=release-1.2.3
+       git+https://example.org/my/repo.git?rev=e72daba8250068216d79d2aeef40d4d95aff6666
+       git://github.com/edolstra/dwarffs.git?ref=flake&rev=2efca4bc9da70fb001b26c3dc858c6397d3c4817
+
+   * /path(\?attr(&attr)*)?
+
+     Like file://path, but if no "ref" or "rev" is specified, the
+     (possibly dirty) working tree will be used. Using a working tree
+     is not allowed in pure evaluation mode.
+
+     Examples:
+
+       /path/to/my/repo
+       /path/to/my/repo?ref=develop
+       /path/to/my/repo?rev=e72daba8250068216d79d2aeef40d4d95aff6666
+
+   * https://<server>/<path>.tar.xz(?hash=<sri-hash>)
+     file:///<path>.tar.xz(?hash=<sri-hash>)
+
+     A flake distributed as a tarball. In pure evaluation mode, an SRI
+     hash is mandatory. It exposes a "lastModified" attribute, being
+     the newest file inside the tarball.
+
+     Example:
+
+       https://releases.nixos.org/nixos/unstable/nixos-19.03pre167858.f2a1a4e93be/nixexprs.tar.xz
+       https://releases.nixos.org/nixos/unstable/nixos-19.03pre167858.f2a1a4e93be/nixexprs.tar.xz?hash=sha256-56bbc099995ea8581ead78f22832fee7dbcb0a0b6319293d8c2d0aef5379397c
+
+  Note: currently, there can be only one flake per Git repository, and
+  it must be at top-level. In the future, we may want to add a field
+  (e.g. "dir=<dir>") to specify a subdirectory inside the repository.
+*/
+
+typedef std::string FlakeId;
+typedef std::string FlakeUri;
+
+struct FlakeRef
+{
+    struct IsId
+    {
+        FlakeId id;
+        bool operator<(const IsId & b) const { return id < b.id; };
+        bool operator==(const IsId & b) const { return id == b.id; };
+    };
+
+    struct IsGitHub {
+        std::string owner, repo;
+        bool operator<(const IsGitHub & b) const {
+            return std::make_tuple(owner, repo) < std::make_tuple(b.owner, b.repo);
+        }
+        bool operator==(const IsGitHub & b) const {
+            return owner == b.owner && repo == b.repo;
+        }
+    };
+
+    // Git, Tarball
+    struct IsGit
+    {
+        std::string uri;
+        bool operator<(const IsGit & b) const { return uri < b.uri; }
+        bool operator==(const IsGit & b) const { return uri == b.uri; }
+    };
+
+    struct IsPath
+    {
+        Path path;
+        bool operator<(const IsPath & b) const { return path < b.path; }
+        bool operator==(const IsPath & b) const { return path == b.path; }
+    };
+
+    // Git, Tarball
+
+    std::variant<IsId, IsGitHub, IsGit, IsPath> data;
+
+    std::optional<std::string> ref;
+    std::optional<Hash> rev;
+    Path subdir = ""; // This is a relative path pointing at the flake.nix file's directory, relative to the git root.
+
+    bool operator<(const FlakeRef & flakeRef) const
+    {
+        return std::make_tuple(data, ref, rev, subdir) <
+            std::make_tuple(flakeRef.data, flakeRef.ref, flakeRef.rev, subdir);
+    }
+
+    bool operator==(const FlakeRef & flakeRef) const
+    {
+        return std::make_tuple(data, ref, rev, subdir) ==
+            std::make_tuple(flakeRef.data, flakeRef.ref, flakeRef.rev, flakeRef.subdir);
+    }
+
+    // Parse a flake URI.
+    FlakeRef(const std::string & uri, bool allowRelative = false);
+
+    // FIXME: change to operator <<.
+    std::string to_string() const;
+
+    /* Check whether this is a "direct" flake reference, that is, not
+       a flake ID, which requires a lookup in the flake registry. */
+    bool isDirect() const
+    {
+        return !std::get_if<FlakeRef::IsId>(&data);
+    }
+
+    /* Check whether this is an "immutable" flake reference, that is,
+       one that contains a commit hash or content hash. */
+    bool isImmutable() const;
+
+    FlakeRef baseRef() const;
+
+    bool isDirty() const
+    {
+        return std::get_if<FlakeRef::IsPath>(&data)
+            && rev == Hash(rev->type);
+    }
+
+    /* Return true if 'other' is not less specific than 'this'. For
+       example, 'nixpkgs' contains 'nixpkgs/release-19.03', and both
+       'nixpkgs' and 'nixpkgs/release-19.03' contain
+       'nixpkgs/release-19.03/<hash>'. */
+    bool contains(const FlakeRef & other) const;
+};
+
+std::ostream & operator << (std::ostream & str, const FlakeRef & flakeRef);
+
+MakeError(BadFlakeRef, Error);
+MakeError(MissingFlake, BadFlakeRef);
+
+std::optional<FlakeRef> parseFlakeRef(
+    const std::string & uri, bool allowRelative = false);
+
+}
diff --git a/src/libexpr/flake/lockfile.cc b/src/libexpr/flake/lockfile.cc
new file mode 100644
index 000000000..93d4ae946
--- /dev/null
+++ b/src/libexpr/flake/lockfile.cc
@@ -0,0 +1,91 @@
+#include "lockfile.hh"
+#include "store-api.hh"
+
+#include <nlohmann/json.hpp>
+
+namespace nix::flake {
+
+LockedInput::LockedInput(const nlohmann::json & json)
+    : LockedInputs(json)
+    , ref(json.value("url", json.value("uri", "")))
+    , originalRef(json.value("originalUrl", json.value("originalUri", "")))
+    , narHash(Hash((std::string) json["narHash"]))
+{
+    if (!ref.isImmutable())
+        throw Error("lockfile contains mutable flakeref '%s'", ref);
+}
+
+nlohmann::json LockedInput::toJson() const
+{
+    auto json = LockedInputs::toJson();
+    json["url"] = ref.to_string();
+    json["originalUrl"] = originalRef.to_string();
+    json["narHash"] = narHash.to_string(SRI);
+    return json;
+}
+
+Path LockedInput::computeStorePath(Store & store) const
+{
+    return store.printStorePath(store.makeFixedOutputPath(true, narHash, "source"));
+}
+
+LockedInputs::LockedInputs(const nlohmann::json & json)
+{
+    for (auto & i : json["inputs"].items())
+        inputs.insert_or_assign(i.key(), LockedInput(i.value()));
+}
+
+nlohmann::json LockedInputs::toJson() const
+{
+    nlohmann::json json;
+    {
+        auto j = nlohmann::json::object();
+        for (auto & i : inputs)
+            j[i.first] = i.second.toJson();
+        json["inputs"] = std::move(j);
+    }
+    return json;
+}
+
+bool LockedInputs::isDirty() const
+{
+    for (auto & i : inputs)
+        if (i.second.ref.isDirty() || i.second.isDirty()) return true;
+
+    return false;
+}
+
+nlohmann::json LockFile::toJson() const
+{
+    auto json = LockedInputs::toJson();
+    json["version"] = 3;
+    return json;
+}
+
+LockFile LockFile::read(const Path & path)
+{
+    if (pathExists(path)) {
+        auto json = nlohmann::json::parse(readFile(path));
+
+        auto version = json.value("version", 0);
+        if (version != 3)
+            throw Error("lock file '%s' has unsupported version %d", path, version);
+
+        return LockFile(json);
+    } else
+        return LockFile();
+}
+
+std::ostream & operator <<(std::ostream & stream, const LockFile & lockFile)
+{
+    stream << lockFile.toJson().dump(4); // '4' = indentation in json file
+    return stream;
+}
+
+void LockFile::write(const Path & path) const
+{
+    createDirs(dirOf(path));
+    writeFile(path, fmt("%s\n", *this));
+}
+
+}
diff --git a/src/libexpr/flake/lockfile.hh b/src/libexpr/flake/lockfile.hh
new file mode 100644
index 000000000..757c37989
--- /dev/null
+++ b/src/libexpr/flake/lockfile.hh
@@ -0,0 +1,85 @@
+#pragma once
+
+#include "flakeref.hh"
+
+#include <nlohmann/json_fwd.hpp>
+
+namespace nix {
+class Store;
+}
+
+namespace nix::flake {
+
+struct LockedInput;
+
+/* Lock file information about the dependencies of a flake. */
+struct LockedInputs
+{
+    std::map<FlakeId, LockedInput> inputs;
+
+    LockedInputs() {};
+    LockedInputs(const nlohmann::json & json);
+
+    nlohmann::json toJson() const;
+
+    /* A lock file is dirty if it contains a dirty flakeref
+       (i.e. reference to a dirty working tree). */
+    bool isDirty() const;
+};
+
+/* Lock file information about a flake input. */
+struct LockedInput : LockedInputs
+{
+    FlakeRef ref, originalRef;
+    Hash narHash;
+
+    LockedInput(const FlakeRef & ref, const FlakeRef & originalRef, const Hash & narHash)
+        : ref(ref), originalRef(originalRef), narHash(narHash)
+    {
+        assert(ref.isImmutable());
+    };
+
+    LockedInput(const nlohmann::json & json);
+
+    bool operator ==(const LockedInput & other) const
+    {
+        return
+            ref == other.ref
+            && narHash == other.narHash
+            && inputs == other.inputs;
+    }
+
+    nlohmann::json toJson() const;
+
+    Path computeStorePath(Store & store) const;
+};
+
+/* An entire lock file. Note that this cannot be a FlakeInput for the
+   top-level flake, because then the lock file would need to contain
+   the hash of the top-level flake, but committing the lock file
+   would invalidate that hash. */
+struct LockFile : LockedInputs
+{
+    bool operator ==(const LockFile & other) const
+    {
+        return inputs == other.inputs;
+    }
+
+    LockFile() {}
+    LockFile(const nlohmann::json & json) : LockedInputs(json) {}
+    LockFile(LockedInput && dep)
+    {
+        inputs = std::move(dep.inputs);
+    }
+
+    nlohmann::json toJson() const;
+
+    static LockFile read(const Path & path);
+
+    void write(const Path & path) const;
+};
+
+std::ostream & operator <<(std::ostream & stream, const LockFile & lockFile);
+
+}
+
diff --git a/src/libexpr/local.mk b/src/libexpr/local.mk
index 26b9f14ba..c2225383f 100644
--- a/src/libexpr/local.mk
+++ b/src/libexpr/local.mk
@@ -4,7 +4,12 @@ libexpr_NAME = libnixexpr
 
 libexpr_DIR := $(d)
 
-libexpr_SOURCES := $(wildcard $(d)/*.cc) $(wildcard $(d)/primops/*.cc) $(d)/lexer-tab.cc $(d)/parser-tab.cc
+libexpr_SOURCES := \
+  $(wildcard $(d)/*.cc) \
+  $(wildcard $(d)/primops/*.cc) \
+  $(wildcard $(d)/flake/*.cc) \
+  $(d)/lexer-tab.cc \
+  $(d)/parser-tab.cc
 
 libexpr_LIBS = libutil libstore libnixrust
 
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 29302c9b6..af6c91954 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -51,20 +51,20 @@ void EvalState::realiseContext(const PathSet & context)
     std::vector<StorePathWithOutputs> drvs;
 
     for (auto & i : context) {
-        std::pair<string, string> decoded = decodeContext(i);
-        auto ctx = store->parseStorePath(decoded.first);
+        auto [ctxS, outputName] = decodeContext(i);
+        auto ctx = store->parseStorePath(ctxS);
         if (!store->isValidPath(ctx))
             throw InvalidPathError(store->printStorePath(ctx));
-        if (!decoded.second.empty() && ctx.isDerivation()) {
-            drvs.push_back(StorePathWithOutputs{ctx.clone(), {decoded.second}});
+        if (!outputName.empty() && ctx.isDerivation()) {
+            drvs.push_back(StorePathWithOutputs{ctx.clone(), {outputName}});
 
             /* Add the output of this derivation to the allowed
                paths. */
             if (allowedPaths) {
-                auto drv = store->derivationFromPath(store->parseStorePath(decoded.first));
-                DerivationOutputs::iterator i = drv.outputs.find(decoded.second);
+                auto drv = store->derivationFromPath(ctx);
+                DerivationOutputs::iterator i = drv.outputs.find(outputName);
                 if (i == drv.outputs.end())
-                    throw Error("derivation '%s' does not have an output named '%s'", decoded.first, decoded.second);
+                    throw Error("derivation '%s' does not have an output named '%s'", ctxS, outputName);
                 allowedPaths->insert(store->printStorePath(i->second.path));
             }
         }
@@ -80,6 +80,7 @@ void EvalState::realiseContext(const PathSet & context)
     StorePathSet willBuild, willSubstitute, unknown;
     unsigned long long downloadSize, narSize;
     store->queryMissing(drvs, willBuild, willSubstitute, unknown, downloadSize, narSize);
+
     store->buildPaths(drvs);
 }
 
diff --git a/src/libexpr/primops/fetchGit.cc b/src/libexpr/primops/fetchGit.cc
index 4aee1073e..80588f54f 100644
--- a/src/libexpr/primops/fetchGit.cc
+++ b/src/libexpr/primops/fetchGit.cc
@@ -1,3 +1,4 @@
+#include "fetchGit.hh"
 #include "primops.hh"
 #include "eval-inline.hh"
 #include "download.hh"
@@ -16,40 +17,115 @@ using namespace std::string_literals;
 
 namespace nix {
 
-struct GitInfo
+extern std::regex revRegex;
+
+static Path getCacheInfoPathFor(const std::string & name, const Hash & rev)
+{
+    Path cacheDir = getCacheDir() + "/nix/git-revs";
+    std::string linkName =
+        name == "source"
+        ? rev.gitRev()
+        : hashString(htSHA512, name + std::string("\0"s) + rev.gitRev()).to_string(Base32, false);
+    return cacheDir + "/" + linkName + ".link";
+}
+
+static void cacheGitInfo(const std::string & name, const GitInfo & gitInfo)
 {
-    Path storePath;
-    std::string rev;
-    std::string shortRev;
-    uint64_t revCount = 0;
-};
+    nlohmann::json json;
+    json["storePath"] = gitInfo.storePath;
+    json["name"] = name;
+    json["rev"] = gitInfo.rev.gitRev();
+    if (gitInfo.revCount)
+        json["revCount"] = *gitInfo.revCount;
+    json["lastModified"] = gitInfo.lastModified;
+
+    auto cacheInfoPath = getCacheInfoPathFor(name, gitInfo.rev);
+    createDirs(dirOf(cacheInfoPath));
+    writeFile(cacheInfoPath, json.dump());
+}
+
+static std::optional<GitInfo> lookupGitInfo(
+    ref<Store> store,
+    const std::string & name,
+    const Hash & rev)
+{
+    try {
+        auto json = nlohmann::json::parse(readFile(getCacheInfoPathFor(name, rev)));
+
+        assert(json["name"] == name && Hash((std::string) json["rev"], htSHA1) == rev);
+
+        Path storePath = json["storePath"];
+
+        if (store->isValidPath(store->parseStorePath(storePath))) {
+            GitInfo gitInfo;
+            gitInfo.storePath = storePath;
+            gitInfo.rev = rev;
+            if (json.find("revCount") != json.end())
+                gitInfo.revCount = json["revCount"];
+            gitInfo.lastModified = json["lastModified"];
+            return gitInfo;
+        }
+
+    } catch (SysError & e) {
+        if (e.errNo != ENOENT) throw;
+    }
 
-std::regex revRegex("^[0-9a-fA-F]{40}$");
+    return {};
+}
 
-GitInfo exportGit(ref<Store> store, const std::string & uri,
-    std::optional<std::string> ref, std::string rev,
+GitInfo exportGit(ref<Store> store, std::string uri,
+    std::optional<std::string> ref,
+    std::optional<Hash> rev,
     const std::string & name)
 {
-    if (evalSettings.pureEval && rev == "")
-        throw Error("in pure evaluation mode, 'fetchGit' requires a Git revision");
+    assert(!rev || rev->type == htSHA1);
+
+    if (rev) {
+        if (auto gitInfo = lookupGitInfo(store, name, *rev)) {
+            // If this gitInfo was produced by exportGitHub, then it won't
+            // have a revCount. So we have to do a full clone.
+            if (gitInfo->revCount) {
+                gitInfo->ref = ref;
+                return *gitInfo;
+            }
+        }
+    }
+
+    if (hasPrefix(uri, "git+")) uri = std::string(uri, 4);
 
-    if (!ref && rev == "" && hasPrefix(uri, "/") && pathExists(uri + "/.git")) {
+    bool isLocal = hasPrefix(uri, "/") && pathExists(uri + "/.git");
 
-        bool clean = true;
+    // If this is a local directory (but not a file:// URI) and no ref
+    // or revision is given, then allow the use of an unclean working
+    // tree.
+    if (!ref && !rev && isLocal) {
+        bool clean = false;
+
+        /* Check whether this repo has any commits. There are
+           probably better ways to do this. */
+        bool haveCommits = !readDirectory(uri + "/.git/refs/heads").empty();
 
         try {
-            runProgram("git", true, { "-C", uri, "diff-index", "--quiet", "HEAD", "--" });
+            if (haveCommits) {
+                runProgram("git", true, { "-C", uri, "diff-index", "--quiet", "HEAD", "--" });
+                clean = true;
+            }
         } catch (ExecError & e) {
             if (!WIFEXITED(e.status) || WEXITSTATUS(e.status) != 1) throw;
-            clean = false;
         }
 
         if (!clean) {
 
             /* This is an unclean working tree. So copy all tracked files. */
+
+            if (!evalSettings.allowDirty)
+                throw Error("Git tree '%s' is dirty", uri);
+
+            if (evalSettings.warnDirty)
+                warn("Git tree '%s' is dirty", uri);
+
             GitInfo gitInfo;
-            gitInfo.rev = "0000000000000000000000000000000000000000";
-            gitInfo.shortRev = std::string(gitInfo.rev, 0, 7);
+            gitInfo.ref = "HEAD";
 
             auto files = tokenizeString<std::set<std::string>>(
                 runProgram("git", true, { "-C", uri, "ls-files", "-z" }), "\0"s);
@@ -70,103 +146,116 @@ GitInfo exportGit(ref<Store> store, const std::string & uri,
             };
 
             gitInfo.storePath = store->printStorePath(store->addToStore("source", uri, true, htSHA256, filter));
+            gitInfo.revCount = haveCommits ? std::stoull(runProgram("git", true, { "-C", uri, "rev-list", "--count", "HEAD" })) : 0;
+            // FIXME: maybe we should use the timestamp of the last
+            // modified dirty file?
+            gitInfo.lastModified = haveCommits ? std::stoull(runProgram("git", true, { "-C", uri, "log", "-1", "--format=%ct", "HEAD" })) : 0;
 
             return gitInfo;
         }
-
-        // clean working tree, but no ref or rev specified.  Use 'HEAD'.
-        rev = chomp(runProgram("git", true, { "-C", uri, "rev-parse", "HEAD" }));
-        ref = "HEAD"s;
     }
 
-    if (!ref) ref = "HEAD"s;
+    if (!ref) ref = isLocal ? "HEAD" : "master";
 
-    if (rev != "" && !std::regex_match(rev, revRegex))
-        throw Error("invalid Git revision '%s'", rev);
+    // Don't clone file:// URIs (but otherwise treat them the same as
+    // remote URIs, i.e. don't use the working tree or HEAD).
+    static bool forceHttp = getEnv("_NIX_FORCE_HTTP") == "1"; // for testing
+    if (!forceHttp && hasPrefix(uri, "file://")) {
+        uri = std::string(uri, 7);
+        isLocal = true;
+    }
 
-    deletePath(getCacheDir() + "/nix/git");
+    Path repoDir;
 
-    Path cacheDir = getCacheDir() + "/nix/gitv2/" + hashString(htSHA256, uri).to_string(Base32, false);
+    if (isLocal) {
 
-    if (!pathExists(cacheDir)) {
-        createDirs(dirOf(cacheDir));
-        runProgram("git", true, { "init", "--bare", cacheDir });
-    }
+        if (!rev)
+            rev = Hash(chomp(runProgram("git", true, { "-C", uri, "rev-parse", *ref })), htSHA1);
 
-    Path localRefFile;
-    if (ref->compare(0, 5, "refs/") == 0)
-        localRefFile = cacheDir + "/" + *ref;
-    else
-        localRefFile = cacheDir + "/refs/heads/" + *ref;
-
-    bool doFetch;
-    time_t now = time(0);
-    /* If a rev was specified, we need to fetch if it's not in the
-       repo. */
-    if (rev != "") {
-        try {
-            runProgram("git", true, { "-C", cacheDir, "cat-file", "-e", rev });
-            doFetch = false;
-        } catch (ExecError & e) {
-            if (WIFEXITED(e.status)) {
-                doFetch = true;
-            } else {
-                throw;
-            }
-        }
-    } else {
-        /* If the local ref is older than ‘tarball-ttl’ seconds, do a
-           git fetch to update the local ref to the remote ref. */
-        struct stat st;
-        doFetch = stat(localRefFile.c_str(), &st) != 0 ||
-            (uint64_t) st.st_mtime + settings.tarballTtl <= (uint64_t) now;
-    }
-    if (doFetch)
-    {
-        Activity act(*logger, lvlTalkative, actUnknown, fmt("fetching Git repository '%s'", uri));
+        repoDir = uri;
 
-        // FIXME: git stderr messes up our progress indicator, so
-        // we're using --quiet for now. Should process its stderr.
-        runProgram("git", true, { "-C", cacheDir, "fetch", "--quiet", "--force", "--", uri, fmt("%s:%s", *ref, *ref) });
+    } else {
 
-        struct timeval times[2];
-        times[0].tv_sec = now;
-        times[0].tv_usec = 0;
-        times[1].tv_sec = now;
-        times[1].tv_usec = 0;
+        Path cacheDir = getCacheDir() + "/nix/gitv3/" + hashString(htSHA256, uri).to_string(Base32, false);
+        repoDir = cacheDir;
 
-        utimes(localRefFile.c_str(), times);
-    }
+        if (!pathExists(cacheDir)) {
+            createDirs(dirOf(cacheDir));
+            runProgram("git", true, { "init", "--bare", repoDir });
+        }
 
-    // FIXME: check whether rev is an ancestor of ref.
-    GitInfo gitInfo;
-    gitInfo.rev = rev != "" ? rev : chomp(readFile(localRefFile));
-    gitInfo.shortRev = std::string(gitInfo.rev, 0, 7);
+        Path localRefFile =
+            ref->compare(0, 5, "refs/") == 0
+            ? cacheDir + "/" + *ref
+            : cacheDir + "/refs/heads/" + *ref;
+
+        bool doFetch;
+        time_t now = time(0);
+
+        /* If a rev was specified, we need to fetch if it's not in the
+           repo. */
+        if (rev) {
+            try {
+                runProgram("git", true, { "-C", repoDir, "cat-file", "-e", rev->gitRev() });
+                doFetch = false;
+            } catch (ExecError & e) {
+                if (WIFEXITED(e.status)) {
+                    doFetch = true;
+                } else {
+                    throw;
+                }
+            }
+        } else {
+            /* If the local ref is older than ‘tarball-ttl’ seconds, do a
+               git fetch to update the local ref to the remote ref. */
+            struct stat st;
+            doFetch = stat(localRefFile.c_str(), &st) != 0 ||
+                (uint64_t) st.st_mtime + settings.tarballTtl <= (uint64_t) now;
+        }
 
-    printTalkative("using revision %s of repo '%s'", gitInfo.rev, uri);
+        if (doFetch) {
+            Activity act(*logger, lvlTalkative, actUnknown, fmt("fetching Git repository '%s'", uri));
 
-    std::string storeLinkName = hashString(htSHA512, name + std::string("\0"s) + gitInfo.rev).to_string(Base32, false);
-    Path storeLink = cacheDir + "/" + storeLinkName + ".link";
-    PathLocks storeLinkLock({storeLink}, fmt("waiting for lock on '%1%'...", storeLink)); // FIXME: broken
+            // FIXME: git stderr messes up our progress indicator, so
+            // we're using --quiet for now. Should process its stderr.
+            try {
+                runProgram("git", true, { "-C", repoDir, "fetch", "--quiet", "--force", "--", uri, fmt("%s:%s", *ref, *ref) });
+            } catch (Error & e) {
+                if (!pathExists(localRefFile)) throw;
+                warn("could not update local clone of Git repository '%s'; continuing with the most recent version", uri);
+            }
 
-    try {
-        auto json = nlohmann::json::parse(readFile(storeLink));
+            struct timeval times[2];
+            times[0].tv_sec = now;
+            times[0].tv_usec = 0;
+            times[1].tv_sec = now;
+            times[1].tv_usec = 0;
 
-        assert(json["name"] == name && json["rev"] == gitInfo.rev);
+            utimes(localRefFile.c_str(), times);
+        }
 
-        gitInfo.storePath = json["storePath"];
+        if (!rev)
+            rev = Hash(chomp(readFile(localRefFile)), htSHA1);
+    }
 
-        if (store->isValidPath(store->parseStorePath(gitInfo.storePath))) {
-            gitInfo.revCount = json["revCount"];
-            return gitInfo;
+    if (auto gitInfo = lookupGitInfo(store, name, *rev)) {
+        if (gitInfo->revCount) {
+            gitInfo->ref = ref;
+            return *gitInfo;
         }
-
-    } catch (SysError & e) {
-        if (e.errNo != ENOENT) throw;
     }
 
+    // FIXME: check whether rev is an ancestor of ref.
+    GitInfo gitInfo;
+    gitInfo.ref = *ref;
+    gitInfo.rev = *rev;
+
+    printTalkative("using revision %s of repo '%s'", gitInfo.rev, uri);
+
+    // FIXME: should pipe this, or find some better way to extract a
+    // revision.
     auto source = sinkToSource([&](Sink & sink) {
-        RunOptions gitOptions("git", { "-C", cacheDir, "archive", gitInfo.rev });
+        RunOptions gitOptions("git", { "-C", repoDir, "archive", gitInfo.rev.gitRev() });
         gitOptions.standardOut = &sink;
         runProgram2(gitOptions);
     });
@@ -178,16 +267,62 @@ GitInfo exportGit(ref<Store> store, const std::string & uri,
 
     gitInfo.storePath = store->printStorePath(store->addToStore(name, tmpDir));
 
-    gitInfo.revCount = std::stoull(runProgram("git", true, { "-C", cacheDir, "rev-list", "--count", gitInfo.rev }));
+    gitInfo.revCount = std::stoull(runProgram("git", true, { "-C", repoDir, "rev-list", "--count", gitInfo.rev.gitRev() }));
+    gitInfo.lastModified = std::stoull(runProgram("git", true, { "-C", repoDir, "log", "-1", "--format=%ct", gitInfo.rev.gitRev() }));
 
-    nlohmann::json json;
-    json["storePath"] = gitInfo.storePath;
-    json["uri"] = uri;
-    json["name"] = name;
-    json["rev"] = gitInfo.rev;
-    json["revCount"] = gitInfo.revCount;
+    cacheGitInfo(name, gitInfo);
+
+    return gitInfo;
+}
+
+GitInfo exportGitHub(
+    ref<Store> store,
+    const std::string & owner,
+    const std::string & repo,
+    std::optional<std::string> ref,
+    std::optional<Hash> rev)
+{
+    if (rev) {
+        if (auto gitInfo = lookupGitInfo(store, "source", *rev))
+            return *gitInfo;
+    }
+
+    if (!rev) {
+        auto url = fmt("https://api.github.com/repos/%s/%s/commits/%s",
+            owner, repo, ref ? *ref : "master");
+        CachedDownloadRequest request(url);
+        request.ttl = rev ? 1000000000 : settings.tarballTtl;
+        auto result = getDownloader()->downloadCached(store, request);
+        auto json = nlohmann::json::parse(readFile(result.path));
+        rev = Hash(json["sha"], htSHA1);
+    }
+
+    // FIXME: use regular /archive URLs instead? api.github.com
+    // might have stricter rate limits.
+
+    auto url = fmt("https://api.github.com/repos/%s/%s/tarball/%s",
+        owner, repo, rev->to_string(Base16, false));
+
+    std::string accessToken = settings.githubAccessToken.get();
+    if (accessToken != "")
+        url += "?access_token=" + accessToken;
+
+    CachedDownloadRequest request(url);
+    request.unpack = true;
+    request.name = "source";
+    request.ttl = 1000000000;
+    request.getLastModified = true;
+    auto result = getDownloader()->downloadCached(store, request);
 
-    writeFile(storeLink, json.dump());
+    assert(result.lastModified);
+
+    GitInfo gitInfo;
+    gitInfo.storePath = result.storePath;
+    gitInfo.rev = *rev;
+    gitInfo.lastModified = *result.lastModified;
+
+    // FIXME: this can overwrite a cache file that contains a revCount.
+    cacheGitInfo("source", gitInfo);
 
     return gitInfo;
 }
@@ -196,7 +331,7 @@ static void prim_fetchGit(EvalState & state, const Pos & pos, Value * * args, Va
 {
     std::string url;
     std::optional<std::string> ref;
-    std::string rev;
+    std::optional<Hash> rev;
     std::string name = "source";
     PathSet context;
 
@@ -213,7 +348,7 @@ static void prim_fetchGit(EvalState & state, const Pos & pos, Value * * args, Va
             else if (n == "ref")
                 ref = state.forceStringNoCtx(*attr.value, *attr.pos);
             else if (n == "rev")
-                rev = state.forceStringNoCtx(*attr.value, *attr.pos);
+                rev = Hash(state.forceStringNoCtx(*attr.value, *attr.pos), htSHA1);
             else if (n == "name")
                 name = state.forceStringNoCtx(*attr.value, *attr.pos);
             else
@@ -230,13 +365,17 @@ static void prim_fetchGit(EvalState & state, const Pos & pos, Value * * args, Va
     // whitelist. Ah well.
     state.checkURI(url);
 
+    if (evalSettings.pureEval && !rev)
+        throw Error("in pure evaluation mode, 'fetchGit' requires a Git revision");
+
     auto gitInfo = exportGit(state.store, url, ref, rev, name);
 
     state.mkAttrs(v, 8);
     mkString(*state.allocAttr(v, state.sOutPath), gitInfo.storePath, PathSet({gitInfo.storePath}));
-    mkString(*state.allocAttr(v, state.symbols.create("rev")), gitInfo.rev);
-    mkString(*state.allocAttr(v, state.symbols.create("shortRev")), gitInfo.shortRev);
-    mkInt(*state.allocAttr(v, state.symbols.create("revCount")), gitInfo.revCount);
+    mkString(*state.allocAttr(v, state.symbols.create("rev")), gitInfo.rev.gitRev());
+    mkString(*state.allocAttr(v, state.symbols.create("shortRev")), gitInfo.rev.gitShortRev());
+    assert(gitInfo.revCount);
+    mkInt(*state.allocAttr(v, state.symbols.create("revCount")), *gitInfo.revCount);
     v.attrs->sort();
 
     if (state.allowedPaths)
diff --git a/src/libexpr/primops/fetchGit.hh b/src/libexpr/primops/fetchGit.hh
new file mode 100644
index 000000000..fe2b49942
--- /dev/null
+++ b/src/libexpr/primops/fetchGit.hh
@@ -0,0 +1,32 @@
+#pragma once
+
+#include "store-api.hh"
+
+#include <regex>
+
+namespace nix {
+
+struct GitInfo
+{
+    Path storePath;
+    std::optional<std::string> ref;
+    Hash rev{htSHA1};
+    std::optional<uint64_t> revCount;
+    time_t lastModified;
+};
+
+GitInfo exportGit(
+    ref<Store> store,
+    std::string uri,
+    std::optional<std::string> ref,
+    std::optional<Hash> rev,
+    const std::string & name);
+
+GitInfo exportGitHub(
+    ref<Store> store,
+    const std::string & owner,
+    const std::string & repo,
+    std::optional<std::string> ref,
+    std::optional<Hash> rev);
+
+}
diff --git a/src/libexpr/primops/fetchMercurial.cc b/src/libexpr/primops/fetchMercurial.cc
index db274fa4f..290cdb0b2 100644
--- a/src/libexpr/primops/fetchMercurial.cc
+++ b/src/libexpr/primops/fetchMercurial.cc
@@ -27,9 +27,6 @@ std::regex commitHashRegex("^[0-9a-fA-F]{40}$");
 HgInfo exportMercurial(ref<Store> store, const std::string & uri,
     std::string rev, const std::string & name)
 {
-    if (evalSettings.pureEval && rev == "")
-        throw Error("in pure evaluation mode, 'fetchMercurial' requires a Mercurial revision");
-
     if (rev == "" && hasPrefix(uri, "/") && pathExists(uri + "/.hg")) {
 
         bool clean = runProgram("hg", true, { "status", "-R", uri, "--modified", "--added", "--removed" }) == "";
@@ -39,7 +36,11 @@ HgInfo exportMercurial(ref<Store> store, const std::string & uri,
             /* This is an unclean working tree. So copy all tracked
                files. */
 
-            printTalkative("copying unclean Mercurial working tree '%s'", uri);
+            if (!evalSettings.allowDirty)
+                throw Error("Mercurial tree '%s' is unclean", uri);
+
+            if (evalSettings.warnDirty)
+                warn("Mercurial tree '%s' is unclean", uri);
 
             HgInfo hgInfo;
             hgInfo.rev = "0000000000000000000000000000000000000000";
@@ -200,6 +201,9 @@ static void prim_fetchMercurial(EvalState & state, const Pos & pos, Value * * ar
     // whitelist. Ah well.
     state.checkURI(url);
 
+    if (evalSettings.pureEval && rev == "")
+        throw Error("in pure evaluation mode, 'fetchMercurial' requires a Mercurial revision");
+
     auto hgInfo = exportMercurial(state.store, url, rev, name);
 
     state.mkAttrs(v, 8);
diff --git a/src/libexpr/value.hh b/src/libexpr/value.hh
index 689373873..60de60c67 100644
--- a/src/libexpr/value.hh
+++ b/src/libexpr/value.hh
@@ -166,6 +166,11 @@ struct Value
     {
         return type == tList1 ? 1 : type == tList2 ? 2 : bigList.size;
     }
+
+    /* Check whether forcing this value requires a trivial amount of
+       computation. In particular, function applications are
+       non-trivial. */
+    bool isTrivial() const;
 };