for your first point., what about `builtins.fetchTarball` and `builtins.fetchurl` (`fetchgit` is in nix unstable afaik)