> One of the key assumptions made by nixpkgs, and by many hermeticity-focused projects, is that URLs stay alive and unmodified. They don’t promise that something will always build. They promise that it will build perfectly, exactly as you specified, or not at all. There’s a nice security element to that I guess.

This shouldn't be the case since the main upstream substituter, cache.nixos.org, should have the derivation cached or at least the latest remote source/binary. MS Teams is an exception since it's licensed as "unfree" which likely prevent caching. I think there's a way to mark the remote src of the package as redistributible (if MS allows that) even if the final package/derivation is not destributible.

Since external sources are content addressed, you can always manually add the source file via the `nix store add-file` or `nix store prefetch-file`.