5 files changed, 26 insertions, 6 deletions
diff --git a/flake.nix b/flake.nix
index 3fb7728..b67caa5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -153,13 +153,16 @@
 
     devShells."${system}" = {
       default = pkgs.mkShell {
-        packages = with pkgs; [
+        packages = [
           pkgs.deploy-rs
 
-          git-bug
+          pkgs.git-bug
 
-          cocogitto
-          ragenix
+          # Used to update the stalwart-mail spamfilter
+          pkgs.nix-update
+
+          pkgs.cocogitto
+          pkgs.ragenix
         ];
       };
     };
diff --git a/pkgs/by-name/st/stalwart-mail-patched/package.nix b/pkgs/by-name/st/stalwart-mail-patched/package.nix
index 9058f2c..85ab840 100644
--- a/pkgs/by-name/st/stalwart-mail-patched/package.nix
+++ b/pkgs/by-name/st/stalwart-mail-patched/package.nix
@@ -9,6 +9,7 @@ in
     pname = "stalwart-mail-patched";
 
     passthru = nixLib.warnMerge (prev.passthru or {}) {
+      # Use a reproducible source for the spamfilter instead of fetching it at runtime from GitHub.
       inherit spamfilter;
     } "stalwart-mail passthru";
 
diff --git a/pkgs/by-name/st/stalwart-mail-patched/spam-filter.nix b/pkgs/by-name/st/stalwart-mail-patched/spam-filter.nix
index ce3466d..32f5e06 100644
--- a/pkgs/by-name/st/stalwart-mail-patched/spam-filter.nix
+++ b/pkgs/by-name/st/stalwart-mail-patched/spam-filter.nix
@@ -4,13 +4,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "spam-filter";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "stalwartlabs";
     repo = "spam-filter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-p2F0bwYBNWeoHjp9csWWaqeOISk9dNQT28OqkhUr7ew=";
+    hash = "sha256-NhD/qUiGhgESwR2IOzAHfDATRlgWMcCktlktvVfDONk=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/st/stalwart-mail-patched/update.sh b/pkgs/by-name/st/stalwart-mail-patched/update.sh
new file mode 100755
index 0000000..f32f117
--- /dev/null
+++ b/pkgs/by-name/st/stalwart-mail-patched/update.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+
+nix-update --file ../../../standalone_pkgs.nix stalwart-mail-patched.passthru.spamfilter --build --option pure-eval false
+
+# vim: ft=sh
diff --git a/pkgs/standalone_pkgs.nix b/pkgs/standalone_pkgs.nix
new file mode 100644
index 0000000..1eeaad3
--- /dev/null
+++ b/pkgs/standalone_pkgs.nix
@@ -0,0 +1,11 @@
+# `nix-update` wants a entry point similar to `release.nix`.
+# This means that we have to fetch our dependencies on our own.
+{}: let
+  get = input: import (builtins.fetchTree input.locked).outPath {};
+
+  lock = (builtins.fromJSON (builtins.readFile ../flake.lock)).nodes;
+  pkgs = get lock.nixpkgs;
+  pkgsUnstable = get lock.nixpkgs-unstable;
+  nixLib = get lock.library;
+in
+  import ./default.nix {inherit pkgs pkgsUnstable nixLib;}