@@ -27,16 +27,16 @@ Rust applications are packaged by using the `buildRustPackage` helper from `rust
2727```
2828rustPlatform.buildRustPackage rec {
2929 pname = "ripgrep";
30− version = "11.0.2";
30+ version = "12.1.1";
3131
3232 src = fetchFromGitHub {
3333 owner = "BurntSushi";
3434 repo = pname;
3535 rev = version;
36− sha256 = "1iga3320mgi7m853la55xip514a3chqsdi1a1rwv25lr9b1p7vd3";
36+ sha256 = "1hqps7l5qrjh9f914r5i6kmcz6f1yb951nv4lby0cjnp5l253kps";
3737 };
3838
39− cargoSha256 = "17ldqr3asrdcsh4l29m3b5r37r5d0b3npq1lrgjmxb6vlx6a36qh";
39+ cargoSha256 = "03wf9r2csi6jpa7v5sw5lpxkrk4wfzwmzx7k3991q3bdjzcwnnwp";
4040
4141 meta = with stdenv.lib; {
4242 description = "A fast line-oriented regex search tool, similar to ag and ack";
@@ -47,10 +47,31 @@ rustPlatform.buildRustPackage rec {
4747}
4848```
4949
50−`buildRustPackage` requires a `cargoSha256` attribute which is computed over
51−all crate sources of this package. Currently it is obtained by inserting a
52−fake checksum into the expression and building the package once. The correct
53−checksum can then be taken from the failed build.
50+`buildRustPackage` requires either the `cargoSha256` or the
51+`cargoHash` attribute which is computed over all crate sources of this
52+package. `cargoHash256` is used for traditional Nix SHA-256 hashes,
53+such as the one in the example above. `cargoHash` should instead be
54+used for [SRI](https://www.w3.org/TR/SRI/) hashes. For example:
55+
56+```
57+ cargoHash = "sha256-l1vL2ZdtDRxSGvP0X/l3nMw8+6WF67KPutJEzUROjg8=";
58+```
59+
60+Both types of hashes are permitted when contributing to nixpkgs. The
61+Cargo hash is obtained by inserting a fake checksum into the
62+expression and building the package once. The correct checksum can
63+then be taken from the failed build. A fake hash can be used for
64+`cargoSha256` as follows:
65+
66+```
67+ cargoSha256 = stdenv.lib.fakeSha256;
68+```
69+
70+For `cargoHash` you can use:
71+
72+```
73+ cargoHash = stdenv.lib.fakeHash;
74+```
5475
5576Per the instructions in the [Cargo Book](https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html)
5677best practices guide, Rust applications should always commit the `Cargo.lock`