{
  pkgs,
  lib,
  sources,
}:
pkgs.writeScriptBin "setup" ''
  set -xe
  # calculated pins
  echo '${lib.strings.toJSON sources}' > ./.npins.json
  # generate TF lock for nix's TF providers
  rm -rf .terraform/
  rm -f .terraform.lock.hcl
  # suppress warning on architecture-specific generated lock file:
  # `Warning: Incomplete lock file information for providers`.
  tofu init -input=false 1>/dev/null
''