NAR hash mismatch on zip file flake inputs only in Nix 2.21.0

[ailocam]

There seems to have been a change in how Zip files are hashed in flakes between 2.20.6 and 2.21.0.

error: NAR hash mismatch in input 'https://storage.googleapis.com/chromium-browser-snapshots/Mac_Arm/1204193/chrome-mac.zip?narHash=sha256-UjmOD5zMSZyZbb05bq1zJTGF1tAuF7oYcyzo4tVu7GQ%3D', expected 'sha256-UjmOD5zMSZyZbb05bq1zJTGF1tAuF7oYcyzo4tVu7GQ=' but got 'sha256-jsM51UJ8/2kfo4FnUjfxAFcWdVRw9BN3NcAu3zprUEY='

Steps To Reproduce

Save these files in working directory
flake.nix

{
  description = "A very basic flake";
  inputs = {
    chromiumBinaryMacArm = { url = "https://storage.googleapis.com/chromium-browser-snapshots/Mac_Arm/1204193/chrome-mac.zip"; flake = false; };
  };
  outputs = inputs: {
    packages.x86_64-linux.default = builtins.toFile "test.txt" "${inputs.chromiumBinaryMacArm}";
  };
}

flake.lock

{
  "nodes": {
    "chromiumBinaryMacArm": {
      "flake": false,
      "locked": {
        "lastModified": 1700534482,
        "narHash": "sha256-UjmOD5zMSZyZbb05bq1zJTGF1tAuF7oYcyzo4tVu7GQ=",
        "type": "tarball",
        "url": "https://storage.googleapis.com/chromium-browser-snapshots/Mac_Arm/1204193/chrome-mac.zip"
      },
      "original": {
        "type": "tarball",
        "url": "https://storage.googleapis.com/chromium-browser-snapshots/Mac_Arm/1204193/chrome-mac.zip"
      }
    },
    "root": {
      "inputs": {
        "chromiumBinaryMacArm": "chromiumBinaryMacArm"
      }
    }
  },
  "root": "root",
  "version": 7
}

The command docker run -it -v $PWD:/app nixos/nix:2.21.0 bash -c "cd /app && nix build --extra-experimental-features 'flakes nix-command'" throws the error

Yet docker run -it -v $PWD:/app nixos/nix:2.20.6 bash -c "cd /app && nix build --extra-experimental-features 'flakes nix-command'" works perfectly.

Expected behavior

The hash in the lock file should be accepted by all versions of Nix, or at least be forwards compatible.

nix-env --version output

nix-env (Nix) 2.21.0

Additional context

Workaround: use the URL scheme file+https:// which causes Nix to not unpack the zip, then handle the unzip manually inside mkDerivation

Priorities

Add 👍 to issues you find important.

[edolstra]

This is fixed in #10675. Note: you may need to rm ~/.cache/nix/fetcher-cache-v*.

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/2024-05-15-nix-team-meeting-minutes-146/45491/1