code review of a download derivation

builder.sh

source "$stdenv/setup"

curl \
    --insecure \
    --retry 3 \
    --netrc-file "$netrc" \
    "$url" > "$out"

default.nix

{ stdenv
, curl
}:

{ netrc
, url
, name
, sha256
}:

stdenv.mkDerivation {
    name = name;
    buildInputs = [ curl ];
    inherit netrc url;
    impureEnvVars = [ "netrc" ];
    builder = ./builder.sh;
    outputHashAlgo = "sha256";
    outputHash = sha256;
    outputHashMode = "flat";
    preferLocalBuild = true;
}