I gained some more understanding on how to check hashes on my own.
I first fetch the hackage tarball and make sure I have exactly that copy locally,
with the same base32 ‘flat’ sha256 as that in hackage-packages.nix
$ nix-prefetch-url https://hackage.haskell.org/package/hledger-1.22.2.tar.gz
path is '/nix/store/qfrxzcyj2a7a8l873a36jqxswy0c9189-hledger-1.22.2.tar.gz'
1g1v56fxgs7ya8yl22brwgrs49a50kd77k8ad8m8l5cnlnviqb3g
$ nix-prefetch-url file://<(cat from-hackage/hledger-1.22.2.tar.gz)
path is '/nix/store/4ckzvvjh43bjrdbfyx6hm5b53g740x88-63'
1g1v56fxgs7ya8yl22brwgrs49a50kd77k8ad8m8l5cnlnviqb3g
Then I build the tarball on my own from the hledger project:
(in the hledger 1.22.2 git repo clone)
$ stack --nix --resolver lts-18 sdist
Then I checked in the wrong way at first whether the tarball from hackage matched the tarball from sdist
$ nix-prefetch-url file://<(cat from-sdist/hledger-1.22.2.tar.gz)
path is '/nix/store/fvvp66ids9k9pw5r3inw8cwq68ah6jw3-63'
082rvrc8bjw549gcm8m803wgl4pa52aj7a78hkagk3ss3iafrsps
The hash differs because there are differences in file attributes (file creation times, etc).
To check the right way, based on what I found on Nix Hash - NixOS Wiki,
the --unpack option is important. It must be used for both the tarball from hackage and
the one from sdist, otherwise I’m not comparing them apple to apple. It will be a ‘recursive’
hash, and so is not expected to match the ‘flat’ hash from earlier, which is fine.
$ nix-prefetch-url --unpack file://<(cat from-hackage/hledger-1.22.2.tar.gz)
path is '/nix/store/17pf2cx2vrs9xicl6pkvvinlzcrxz1p4-63'
1b10c5j7hgxpx1vgca8qyy3ym0fjyk4v6ch3p87a096a6iby01p9
$ nix-prefetch-url --unpack file://<(cat from-sdist/hledger-1.22.2.tar.gz)
path is '/nix/store/17pf2cx2vrs9xicl6pkvvinlzcrxz1p4-63'
1b10c5j7hgxpx1vgca8qyy3ym0fjyk4v6ch3p87a096a6iby01p9
Now I know the tarball on hackage matches what was in the git repo for the version in question.
Then to ensure the sha256 is being checked (for my own peace of mind), I used an invalid sha256 in a fetchurl call
$ NIX_MIRRORS_hackage="https://hackage.haskell.org/package/" nix repl
Welcome to Nix 2.6.0. Type :? for help.
nix-repl> builtins.fetchurl {
url = "mirror://hackage/hledger-1.22.2.tar.gz";
sha256 = "0v6r3wwnsk5pdjr188nip3pjgn1jrn5pc5ajpcfy6had6b3v4dwm";
}
error: hash mismatch in file downloaded from 'https://hackage.haskell.org/package/hledger-1.22.2.tar.gz':
specified: sha256:0v6r3wwnsk5pdjr188nip3pjgn1jrn5pc5ajpcfy6had6b3v4dwm
got: sha256:1g1v56fxgs7ya8yl22brwgrs49a50kd77k8ad8m8l5cnlnviqb3g
Nice. But to check that hackages-packages.nix benefits from the same check, I replaced in hackage-packages.nix (locally)
mkDerivation {
pname = "hledger";
version = "1.22.2";
# sha256 = "1g1v56fxgs7ya8yl22brwgrs49a50kd77k8ad8m8l5cnlnviqb3g";
sha256 = "1g1v56fxgs7ya8yl22brwgrs49a50kd77k8ad8m8l5cnlnviqb3h"; # <- notice the last character was changed to 'h'
And in order for the nix-daemon to fetch tarballs over HTTPS (HTTP packets being dropped and causing timeouts)
$ sudo systemctl edit nix-daemon.service
[Service]
Environment="NIX_CONNECT_TIMEOUT=1"
Environment="NIX_HASHED_MIRRORS=https://tarballs.nixos.org"
Environment="NIX_MIRRORS_hackage=https://hackage.haskell.org/package/"
...
$ sudo systemctl daemon-reload
$ sudo systemctl restart nix-daemon.service
$ sudo systemctl show nix-daemon.service | grep Env
Environment=NIX_CONNECT_TIMEOUT=1 NIX_HASHED_MIRRORS=https://tarballs.nixos.org NIX_MIRRORS_hackage=https://hackage.haskell.org/package/
I then expected to get a hash error upon building the derivation where I injected an error in the hash:
(in nixpkgs-f8f124009497b3f9908f395d2533a990feee1de8)
$ nix repl .
Welcome to Nix 2.6.0. Type :? for help.
Loading '.'...
Added 14996 variables.
nix-repl> :b haskellPackages.hledger_1_22_2
error: hash mismatch in fixed-output derivation '/nix/store/iz354wx38sqq87vn7ia8m8zm7jm0liwk-hledger-1.22.2.tar.gz.drv':
specified: sha256-cCwct6WWFYoqagrNc9oERSWi8+N5CUE9Uv7o150pO7w=
got: sha256-bywct6WWFYoqagrNc9oERSWi8+N5CUE9Uv7o150pO7w=
error: 1 dependencies of derivation '/nix/store/k6si40n8drn94sba0c0cz5460s8vnb92-hledger-1.22.2.drv' failed to build
[0 built (1 failed)]
Nice. Notice that the hash mismatch error message is slightly different, referring to ‘fixed-output derivation’ compared to the earlier ‘file downloaded’ hash mismatch.
So now I can build older versions knowing that I understand how source tarballs are obtained and checked. And If I need to, I can produce my own tarballs (at last for haskell packages). And I can also activate HTTPS (if I so desire).
I found the fixed derivation hash mismatch error message in pkgs/common-updater/scripts/update-source-version so I now know where to look if I want to understand what’s going on. I won’t need to just yet.
Putting this lengthy reply in case it will help someone else someday.