outputHash can be null when outputHashAlgo is provided

[ryantrinkle]

As a result, fetchurl as currently provided by nixpkgs can be invoked impurely, e.g.: fetchurl { url = "http://www.time.gov/actualtime.cgi"; sha256 = null; }.

Thanks to @grahamc for putting together this example:

let
  pkgs = import <nixpkgs> {};
in pkgs.stdenv.mkDerivation {
  name = "hi";

  phases = [ "buildPhase" ];
  buildInputs = with pkgs; [
    curl
  ];
  buildPhase = ''
    curl http://icanhazip.com > $out
  '';

  outputHashAlgo = "sha256";
  outputHash = null;
  outputHashMode = "recursive";
}

Enabling sandboxing prevents the derivation from building, of course, which prevents the impurity.