From c8cf70b6010596953d384a9e2b7faf4a66bee583 Mon Sep 17 00:00:00 2001
From: Charles Hall <charles@computer.surgery>
Date: Sun, 16 Feb 2025 15:58:51 -0800
Subject: [PATCH] use sri hash format in fetch{url,Tarball} errors

Specifically, for errors where the provided and expected hashes differ.

Also, I've updated `fetchTarball`'s docs to explain the allowed values
for the `sha256` attribute.

Change-Id: Ic9aa777dc0a3c1ccdb4c98048745067f529bd986
---
 lix/libexpr/builtins/fetchTarball.md | 12 +++++++++++-
 lix/libexpr/primops/fetchTree.cc     |  4 ++--
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/lix/libexpr/builtins/fetchTarball.md b/lix/libexpr/builtins/fetchTarball.md
index b0a2c750c..cb20ec156 100644
--- a/lix/libexpr/builtins/fetchTarball.md
+++ b/lix/libexpr/builtins/fetchTarball.md
@@ -33,10 +33,20 @@ the attribute `url` and the attribute `sha256`, e.g.
 ```nix
 with import (fetchTarball {
   url = "https://github.com/NixOS/nixpkgs/archive/nixos-14.12.tar.gz";
-  sha256 = "1jppksrfvbk5ypiqdz4cddxdl8z6zyzdb2srq8fcffr327ld5jj2";
+  sha256 = "sha256-QsrS6BEjO8ccwlmL1b7/5iPaemuM/Ibj9WWu7bKe98o=";
 }) {};
 
 stdenv.mkDerivation { … }
 ```
 
+The `sha256` attribute accepts Nix-style base32 sha256 hashes (e.g.
+`1jppksrfvbk5ypiqdz4cddxdl8z6zyzdb2srq8fcffr327ld5jj2`), hashes
+in SRI format (as shown above), and some other less common hash
+algorithms and formats.
+
+<!--
+  TODO: Document all the accepted hash algorithms and formats
+  somewhere in the manual and link to it from here.
+-->
+
 Not available in [restricted evaluation mode](@docroot@/command-ref/conf-file.md#conf-restrict-eval).
diff --git a/lix/libexpr/primops/fetchTree.cc b/lix/libexpr/primops/fetchTree.cc
index 61d3fb9c0..b3fdcddb4 100644
--- a/lix/libexpr/primops/fetchTree.cc
+++ b/lix/libexpr/primops/fetchTree.cc
@@ -286,8 +286,8 @@ static void fetch(EvalState & state, const PosIdx pos, Value * * args, Value & v
             state.ctx.errors.make<EvalError>(
                 "hash mismatch in file downloaded from '%s':\n  specified: %s\n  got:       %s",
                 *url,
-                expectedHash->to_string(Base::Base32, true),
-                hash.to_string(Base::Base32, true)
+                expectedHash->to_string(Base::SRI, true),
+                hash.to_string(Base::SRI, true)
             ).withExitStatus(102)
             .debugThrow();
         }