I'm doing something way nastier:

systemd-repart = pkgsUnstable.systemdMinimal.overrideAttrs (finalAttrs: previousAttrs: {
      src = prev.fetchFromGitHub {
        owner = "systemd";
        repo = "systemd";
        rev = "1eb86ddde4f36165a99732b53cc97cef1acc3aa7";
        hash = "sha256-Frf0QwJCw/fG+YQ/+frqq8aD2Jv32Ozw1JMwjZSBTHc=";
      };

      # Only this patch is necessary to build systemd. This package will not be
      # usable as a general replacement of systemd for NixOS but the tools like
      # systemd-repart will work.
      patches = [ (builtins.elemAt previousAttrs.patches 10) ];
    });

Not yet in the wild. This is what I currently do:

fakeroot systemd-repart \
              --dry-run=no \
              --empty=create \
              --size=auto \
              --root=buildroot \
              --definitions="$repartDefinitions" \
              --split=true \
              image.raw

which is definetely not enough for reproducibility

In reply to @arianvp:matrix.org
we don't support user namespaces inside the build sandbox do we? or do we these days?

In reply to @nikstur:matrix.org
If there is no machine-id systemd-repart creates random UUIDs for partitions

hmmmm without fakeroot my build fails with:

 > Failed to copy symlink 'sbin', ignoring: Permission denied
       > Failed to copy '/nix/store/049705cr0z1mzjfngjr4vlybp3z5n1wx-bcache-tools-1.0.7' to '/build/.#repartabde6bac7950c286/nix/store/049705cr0z1mzjfngjr4vlybp3z5n1wx-bcache-tools-1.0.7': Invalid argument

In reply to @arianvp:matrix.org
but works with fakeroot woohoo. (What does fakeroot do?

In reply to @arianvp:matrix.org
that I understand. but how does it do that?

This is done by setting LD_PRELOAD to libfakeroot.so, which provides wrappers around getuid, chown, chmod, mknod, stat, and so on, thereby creating a fake root environment.

In reply to @elvishjerricco:matrix.org
user namespaces are better though. Are there still holdout distros that disable that?