search

andir / npins

Nix dependency pinning. Very similar to Niv but has a few features that I personally wanted.
European Union Public License 1.2
164 stars 12 forks source link

Change `git` inputs to use SRI hashes #71

Open lf- opened 2 months ago

lf- commented 2 months ago

Currently npins uses legacy Nix base32 hashes for fetchGit. I would like to be able to passnarHash to fetchGit to get it to hit cache for any user connecting to the same the Nix store rather than just getting cached in the Nix git cache, but Nix only allows SRI hashes for that parameter.

I think the easiest fix here is to make npins store SRIs for such hashes, since I don't think the base32 hashes could actually be used for any purpose in the current state anyway.

andir commented 2 months ago

I like the idea if that improves the caching / substitution situation. Out of interest: Do you know the minimum Nix version required for these?

We should probably also support migration of the hashes. At least only change "updated" hashes to not cause issues with "dormant" dependencies? (e.g. fetching huge repos again just for the sake of hashing)

RaitoBezarius commented 1 month ago

Between 2.3 and 2.4, it's in 2.4. I cannot find it in 2.3, at least, narHash is not a supported argument of 2.3's fetchGit.

RaitoBezarius commented 1 month ago

In addition, nix hash to-sri probably exist only in 2.4+, if you want to implement the migration or initialization using #87 code. An alternative is to rely on Tvix to generate those without any dependency upon Nix, but well, you already know all of that :P.

philiptaron commented 1 month ago

SRI hashes were added to Nix with https://github.com/NixOS/nix/commit/6024dc1d97212130c19d3ff5ce6b1d102837eee6. That appears to have shipped in Nix 2.2. That commit changes the fetchurl builtin; fetchgit was changed in https://github.com/NixOS/nix/commit/6024dc1d97212130c19d3ff5ce6b1d102837eee6 (I think) which shipped in 2.4, it looks like.