6024dc1d97
SRI hashes (https://www.w3.org/TR/SRI/) combine the hash algorithm and a base-64 hash. This allows more concise and standard hash specifications. For example, instead of import <nix/fetchurl.nl> { url = https://nixos.org/releases/nix/nix-2.1.3/nix-2.1.3.tar.xz; sha256 = "5d22dad058d5c800d65a115f919da22938c50dd6ba98c5e3a183172d149840a4"; }; you can write import <nix/fetchurl.nl> { url = https://nixos.org/releases/nix/nix-2.1.3/nix-2.1.3.tar.xz; hash = "sha256-XSLa0FjVyADWWhFfkZ2iKTjFDda6mMXjoYMXLRSYQKQ="; }; In fixed-output derivations, the outputHashAlgo is no longer mandatory if outputHash specifies the hash (either as an SRI or in the old "<type>:<hash>" format). 'nix hash-{file,path}' now print hashes in SRI format by default. I also reverted them to use SHA-256 by default because that's what we're using most of the time in Nixpkgs. Suggested by @zimbatm.
42 lines
1.2 KiB
Nix
42 lines
1.2 KiB
Nix
{ system ? "" # obsolete
|
|
, url
|
|
, hash ? "" # an SRI ash
|
|
|
|
# Legacy hash specification
|
|
, md5 ? "", sha1 ? "", sha256 ? "", sha512 ? ""
|
|
, outputHash ?
|
|
if hash != "" then hash else if sha512 != "" then sha512 else if sha1 != "" then sha1 else if md5 != "" then md5 else sha256
|
|
, outputHashAlgo ?
|
|
if hash != "" then "" else if sha512 != "" then "sha512" else if sha1 != "" then "sha1" else if md5 != "" then "md5" else "sha256"
|
|
|
|
, executable ? false
|
|
, unpack ? false
|
|
, name ? baseNameOf (toString url)
|
|
}:
|
|
|
|
derivation {
|
|
builder = "builtin:fetchurl";
|
|
|
|
# New-style output content requirements.
|
|
inherit outputHashAlgo outputHash;
|
|
outputHashMode = if unpack || executable then "recursive" else "flat";
|
|
|
|
inherit name url executable unpack;
|
|
|
|
system = "builtin";
|
|
|
|
# No need to double the amount of network traffic
|
|
preferLocalBuild = true;
|
|
|
|
impureEnvVars = [
|
|
# We borrow these environment variables from the caller to allow
|
|
# easy proxy configuration. This is impure, but a fixed-output
|
|
# derivation like fetchurl is allowed to do so since its result is
|
|
# by definition pure.
|
|
"http_proxy" "https_proxy" "ftp_proxy" "all_proxy" "no_proxy"
|
|
];
|
|
|
|
# To make "nix-prefetch-url" work.
|
|
urls = [ url ];
|
|
}
|