git.iko.soy/typeable/nixpkgs
on master help sign in
buildRustPackage: add `cargoHash` for SRI hashes of vendored deps

`buildRustPackage` currently accepts `cargoSha256` as a hash for vendored dependencies. This change adds `cargoHash` which accepts SRI hashes, setting `outputHashAlgo` to `null`. The hash mismatch message still uses `cargoSha256` as an example, which it probably should until we completely switch to SRI hashes.

commit67a10c88bbf0d359d71485decd002c6303351f2f authorDaniël de Kok <me@danieldk.eu> dateSun 8 Nov 2020, 08:47 (6 years ago) parent3d2ffa3
3 files changed+21−9
compare with master
unifiedsplit
pkgs/build-support/rust/default.nix+10−3 pkgs/build-support/rust/fetchCargoTarball.nix+10−5 pkgs/tools/misc/broot/default.nix+1−1
pkgs/build-support/rust/default.nix+10−3
@@ -15,7 +15,13 @@
1515}:
1616
1717{ name ? "${args.pname}-${args.version}"
18−, cargoSha256 ? "unset"
18+
19+ # SRI hash
20+, cargoHash ? ""
21+
22+ # Legacy hash
23+, cargoSha256 ? ""
24+
1925, src ? null
2026, srcs ? null
2127, unpackPhase ? null
@@ -46,7 +52,7 @@
4652, buildAndTestSubdir ? null
4753, ... } @ args:
4854
49−assert cargoVendorDir == null -> cargoSha256 != "unset";
55+assert cargoVendorDir == null -> !(cargoSha256 == "" && cargoHash == "");
5056assert buildType == "release" || buildType == "debug";
5157
5258let
@@ -54,6 +60,7 @@ let
5460 cargoDeps = if cargoVendorDir == null
5561 then fetchCargoTarball ({
5662 inherit name src srcs sourceRoot unpackPhase cargoUpdateHook;
63+ hash = cargoHash;
5764 patches = cargoPatches;
5865 sha256 = cargoSha256;
5966 } // depsExtraArgs)
@@ -61,7 +68,7 @@ let
6168
6269 # If we have a cargoSha256 fixed-output derivation, validate it at build time
6370 # against the src fixed-output derivation to check consistency.
64− validateCargoDeps = cargoSha256 != "unset";
71+ validateCargoDeps = !(cargoHash == "" && cargoSha256 == "");
6572
6673 # Some cargo builds include build hooks that modify their own vendor
6774 # dependencies. This copies the vendor directory into the build tree and makes
pkgs/build-support/rust/fetchCargoTarball.nix+10−5
@@ -22,11 +22,17 @@ in
2222, srcs ? []
2323, patches ? []
2424, sourceRoot
25−, sha256
25+, hash ? ""
26+, sha256 ? ""
2627, cargoUpdateHook ? ""
2728, ...
2829} @ args:
29−stdenv.mkDerivation ({
30+
31+let hash_ =
32+ if hash != "" then { outputHashAlgo = null; outputHash = hash; }
33+ else if sha256 != "" then { outputHashAlgo = "sha256"; outputHash = sha256; }
34+ else throw "fetchCargoTarball requires a hash for ${name}";
35+in stdenv.mkDerivation ({
3036 name = "${name}-vendor.tar.gz";
3137 nativeBuildInputs = [ cacert git cargo-vendor-normalise cargo ];
3238
@@ -40,7 +46,7 @@ stdenv.mkDerivation ({
4046 echo
4147 echo "ERROR: The Cargo.lock file doesn't exist"
4248 echo
43− echo "Cargo.lock is needed to make sure that cargoSha256 doesn't change"
49+ echo "Cargo.lock is needed to make sure that cargoHash/cargoSha256 doesn't change"
4450 echo "when the registry is updated."
4551 echo
4652
@@ -72,8 +78,7 @@ stdenv.mkDerivation ({
7278 -czf $out $name
7379 '';
7480
75− outputHashAlgo = "sha256";
76− outputHash = sha256;
81+ inherit (hash_) outputHashAlgo outputHash;
7782
7883 impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars;
7984} // (builtins.removeAttrs args [
pkgs/tools/misc/broot/default.nix+1−1
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage rec {
1818 sha256 = "04nidx43w4nnccgbrw30wg9ai8p7hbklxpn1gc6gr2325yhqvwhl";
1919 };
2020
21− cargoSha256 = "1bzq0dsdnmxniwnb6989wlhih28c4lyd11sci821whs11lhlfpz0";
21+ cargoHash = "sha256-4F9HIQ1BQx4EikyH0DwlDAkYIeUJJbMsj7ZX23QD+K8=";
2222
2323 nativeBuildInputs = [
2424 makeWrapper