Fix hashes and update-hashes.sh

Author: thomasjm

flake.nix

@@ -17,11 +17,11 @@
         nixTarballs = {
           x86_64-linux = {
             url = "https://github.com/codedownio/desktop/releases/download/v${version}/nix-static-2.32.4-x86_64-linux.tar.gz"; # nix-tarball-x86_64-url
-            hash = "sha256-2cCIQEsvcUcojhPzy731GnpDVTwWrxfa75KvxLLeOk8="; # nix-tarball-x86_64-hash
+            hash = "sha256-Wh+6GqkmDbRel+Tgzia7eJlIy8xjWKaLRINwuSYvxpo="; # nix-tarball-x86_64-hash
           };
           aarch64-linux = {
             url = "https://github.com/codedownio/desktop/releases/download/v${version}/nix-static-2.32.4-aarch64-linux.tar.gz"; # nix-tarball-aarch64-url
-            hash = "sha256-qvwDG5lyd1qJw2ADNGhFVS+f6h4d3AKpB82vdUT0oH0="; # nix-tarball-aarch64-hash
+            hash = "sha256-DFje+EYeYMlx5IKCAnspHjLikuhjFzYljSo6Ac1W9SI="; # nix-tarball-aarch64-hash
           };
         };
 
@@ -43,11 +43,11 @@
         screenshotterTarballs = {
           x86_64-linux = {
             url = "https://github.com/codedownio/desktop/releases/download/v${version}/codedown-screenshotter-0.1.1-x86_64-linux.tar.gz"; # screenshotter-tarball-x86_64-url
-            hash = "sha256-cWjXVhAU48YT1rVfk9epxBVGkIs3QqGBkCqX41RrKp4="; # screenshotter-tarball-x86_64-hash
+            hash = "sha256-MJrYoEjcW5pAsiUV5Zmq6K8M4hZK5t3ETkYHCmvl/w0="; # screenshotter-tarball-x86_64-hash
           };
           aarch64-linux = {
             url = "https://github.com/codedownio/desktop/releases/download/v${version}/codedown-screenshotter-0.1.1-aarch64-linux.tar.gz"; # screenshotter-tarball-aarch64-url
-            hash = "sha256-AdQwie5JWqaHUHDW46uG39nRmFF3WlwyLoDDNRp2R+Q="; # screenshotter-tarball-aarch64-hash
+            hash = "sha256-j/IspnxxnzWBKj4nkg4NU1tqKQ5JMo47IqVdEPWLBbM="; # screenshotter-tarball-aarch64-hash
           };
         };
 

update-hashes.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils gnused gnugrep findutils nix
+#!nix-shell -i bash -p coreutils gnused gnugrep findutils nix jq
 
 set -euo pipefail
 
@@ -17,10 +17,37 @@ fi
 echo "Found version: $VERSION"
 echo ""
 
-# Function to update a hash for a given URL comment marker
+# Compute hash for fetchzip with stripRoot=true (the default).
+# nix store prefetch-file --unpack strips root, matching fetchzip's default.
+prefetch_hash_strip_root() {
+    local url="$1"
+    nix store prefetch-file --unpack --json "$url" 2>/dev/null | jq -r .hash
+}
+
+# Compute hash for fetchzip with stripRoot=false.
+# Neither nix-prefetch-url --unpack nor nix store prefetch-file --unpack can
+# disable root stripping, so we ask Nix to evaluate the actual fetchzip
+# derivation with a fake hash and extract the correct hash from the error.
+prefetch_hash_no_strip_root() {
+    local url="$1"
+    local output
+    output=$(nix-build --no-out-link --expr "
+      with import <nixpkgs> {};
+      fetchzip {
+        url = \"$url\";
+        sha256 = \"sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\";
+        stripRoot = false;
+      }
+    " 2>&1 || true)
+    echo "$output" | grep -oP 'got:\s+\Ksha256-[A-Za-z0-9+/=]+'
+}
+
+# Function to update a hash for a given URL comment marker.
+# Pass "no-strip" as $3 for fetchzip entries with stripRoot = false.
 update_hash() {
     local url_marker="$1"
     local hash_marker="$2"
+    local strip_mode="${3:-strip}"
 
     # Extract the URL line and parse out the URL template
     local url_line=$(grep "# $url_marker\$" "$FLAKE_NIX")
@@ -38,8 +65,12 @@ update_hash() {
 
     echo "Fetching: $url"
 
-    # Use nix-prefetch-url to get the hash (--unpack for tarballs used with fetchzip)
-    local hash=$(nix-prefetch-url --unpack "$url" 2>/dev/null | xargs nix hash convert --hash-algo sha256 --to sri)
+    local hash
+    if [[ "$strip_mode" == "no-strip" ]]; then
+        hash=$(prefetch_hash_no_strip_root "$url")
+    else
+        hash=$(prefetch_hash_strip_root "$url")
+    fi
 
     if [[ -z "$hash" ]]; then
         echo "Error: Failed to fetch hash for $url"
@@ -54,28 +85,29 @@ update_hash() {
 }
 
 # Update all hashes
+# Pass "no-strip" for fetchzip entries that use stripRoot = false
 echo "Updating nix-tarball hashes..."
-update_hash "nix-tarball-x86_64-url" "nix-tarball-x86_64-hash"
-update_hash "nix-tarball-aarch64-url" "nix-tarball-aarch64-hash"
+update_hash "nix-tarball-x86_64-url" "nix-tarball-x86_64-hash" no-strip
+update_hash "nix-tarball-aarch64-url" "nix-tarball-aarch64-hash" no-strip
 
 echo ""
 echo "Updating server-tarball hashes..."
-update_hash "server-tarball-x86_64-url" "server-tarball-x86_64-hash"
-update_hash "server-tarball-aarch64-url" "server-tarball-aarch64-hash"
+update_hash "server-tarball-x86_64-url" "server-tarball-x86_64-hash" strip
+update_hash "server-tarball-aarch64-url" "server-tarball-aarch64-hash" no-strip
 
 echo ""
 echo "Updating screenshotter-tarball hashes..."
-update_hash "screenshotter-tarball-x86_64-url" "screenshotter-tarball-x86_64-hash"
-update_hash "screenshotter-tarball-aarch64-url" "screenshotter-tarball-aarch64-hash"
+update_hash "screenshotter-tarball-x86_64-url" "screenshotter-tarball-x86_64-hash" no-strip
+update_hash "screenshotter-tarball-aarch64-url" "screenshotter-tarball-aarch64-hash" no-strip
 
 echo ""
 echo "Updating runner-bin-dir hashes..."
-update_hash "runner-bin-dir-x86_64-url" "runner-bin-dir-x86_64-hash"
-update_hash "runner-bin-dir-aarch64-url" "runner-bin-dir-aarch64-hash"
+update_hash "runner-bin-dir-x86_64-url" "runner-bin-dir-x86_64-hash" no-strip
+update_hash "runner-bin-dir-aarch64-url" "runner-bin-dir-aarch64-hash" no-strip
 
 echo ""
 echo "Updating frontend hash..."
-update_hash "frontend-url" "frontend-hash"
+update_hash "frontend-url" "frontend-hash" no-strip
 
 echo ""
 echo "Done!"