use sri hash format in fetch{url,Tarball} errors

Specifically, for errors where the provided and expected hashes differ.

Also, I've updated `fetchTarball`'s docs to explain the allowed values
for the `sha256` attribute.

Change-Id: Ic9aa777dc0a3c1ccdb4c98048745067f529bd986
This commit is contained in:
Charles Hall
2025-02-17 12:04:16 -08:00
parent d745b28500
commit c8cf70b601
2 changed files with 13 additions and 3 deletions
+11 -1
View File
@@ -33,10 +33,20 @@ the attribute `url` and the attribute `sha256`, e.g.
```nix
with import (fetchTarball {
url = "https://github.com/NixOS/nixpkgs/archive/nixos-14.12.tar.gz";
sha256 = "1jppksrfvbk5ypiqdz4cddxdl8z6zyzdb2srq8fcffr327ld5jj2";
sha256 = "sha256-QsrS6BEjO8ccwlmL1b7/5iPaemuM/Ibj9WWu7bKe98o=";
}) {};
stdenv.mkDerivation { }
```
The `sha256` attribute accepts Nix-style base32 sha256 hashes (e.g.
`1jppksrfvbk5ypiqdz4cddxdl8z6zyzdb2srq8fcffr327ld5jj2`), hashes
in SRI format (as shown above), and some other less common hash
algorithms and formats.
<!--
TODO: Document all the accepted hash algorithms and formats
somewhere in the manual and link to it from here.
-->
Not available in [restricted evaluation mode](@docroot@/command-ref/conf-file.md#conf-restrict-eval).
+2 -2
View File
@@ -286,8 +286,8 @@ static void fetch(EvalState & state, const PosIdx pos, Value * * args, Value & v
state.ctx.errors.make<EvalError>(
"hash mismatch in file downloaded from '%s':\n specified: %s\n got: %s",
*url,
expectedHash->to_string(Base::Base32, true),
hash.to_string(Base::Base32, true)
expectedHash->to_string(Base::SRI, true),
hash.to_string(Base::SRI, true)
).withExitStatus(102)
.debugThrow();
}