Pin nixpkgs (#898)

stack-deps.nix

@@ -1,5 +1,22 @@
-{ pkgs ? import <nixpkgs> {} }:
 let 
+  # Pin nixpkgs for all dependencies.
+  # If you want to update.
+  # 1. go to https://nixos.org/channels/nixos-19.09
+  # 2. copy the URL to nixexprs.tar.gz and the sha256 hash
+  # 3. Uncomment the  sha256 = 00000 field
+  # 4. nix-build
+  # 5. Make nix complain to you what the correct hash is.
+  # 6. comment sha256 = 0000 and   add sha256 = <actual-hash>
+  # 7. nix-build
+  # 8. commit
+  # TODO(arianvp): There are tools that automate this; we should use them
+  pkgsTar = builtins.fetchTarball {
+    name = "nixos-1909";
+    url = "https://releases.nixos.org/nixos/19.09/nixos-19.09.1019.c5aabb0d603/nixexprs.tar.xz";
+    sha256 = "1hjw843g964aj9cd9p6x5473yy4sfmqnqlvavc5c1lbqa8v676zg";
+    # sha256 = "0000000000000000000000000000000000000000000000000000";
+  };
+  pkgs = import pkgsTar {};
   cryptobox-c = pkgs.callPackage ({fetchFromGitHub, rustPlatform,  pkgconfig, libsodium}:
     rustPlatform.buildRustPackage rec {
       name = "cryptobox-c-${version}";