Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

change hash algorithm compatible for fetchNextcloudApp #3

Merged
merged 1 commit into from Mar 1, 2024

Conversation

onny
Copy link
Contributor

@onny onny commented Dec 8, 2022

No description provided.

@Scriptkiddi
Copy link
Contributor

Hey isnt there a better way to calculate that hash instead of spawing seperate processes? And why is this a good idea?

@onny
Copy link
Contributor Author

onny commented Jun 2, 2023

@Scriptkiddi I guess calculating hashes has changed since NixOS/nixpkgs#193075 and nc4nix probably didn't got updated yet.
Yeah it would be cool to calculate it with Go but not sure how to do it

@Scriptkiddi
Copy link
Contributor

I think we should rework this to go code and then merge it

@onny
Copy link
Contributor Author

onny commented Feb 5, 2024

I think we should rework this to go code and then merge it

Found a way to calculate the hash in Go without depending on external commands :)

@onny
Copy link
Contributor Author

onny commented Feb 6, 2024

@Scriptkiddi @dasJ

go.mod Show resolved Hide resolved
main.go Outdated Show resolved Hide resolved
main.go Outdated Show resolved Hide resolved
main.go Outdated Show resolved Hide resolved
main.go Outdated Show resolved Hide resolved
@onny onny force-pushed the hashing-algo branch 2 times, most recently from 1d75aef to 9f50c21 Compare February 8, 2024 12:22
@onny
Copy link
Contributor Author

onny commented Feb 8, 2024

Thank you @leonklingele , fixed the issues 👍

main.go Outdated Show resolved Hide resolved
@onny
Copy link
Contributor Author

onny commented Feb 9, 2024

Oh missed that, thank you!

@onny
Copy link
Contributor Author

onny commented Feb 12, 2024

@ajs124 @Mr-Pi

@onny
Copy link
Contributor Author

onny commented Feb 15, 2024

Is there anything I can test or further add please let me know :)

@leonklingele
Copy link
Member

@onny thanks! Code-wise this lgtm, what's the intention behind this change though? Does the current version (i.e. latest master) yields any different (incorrect?) hashes?

@onny
Copy link
Contributor Author

onny commented Feb 19, 2024

yes the hash is now different, probably because fetchnextcloudapp requires a recursive hash, not of the single zip file like before, but of the zip content recursively https://github.com/NixOS/nixpkgs/blob/c5e62ec76a0198822c1cf017f83c1d4c9d1ceb60/pkgs/servers/nextcloud/packages/default.nix#L18

@leonklingele
Copy link
Member

To me this change looks like it's switching to the new hash representation used by nix which additionally allows for different hashing algorithms (e.g. sha1, .. instead of sha256). i.e., it's not changing the hash, it's merely using a different encoding of it.

@Conni2461 @dasJ what do you think? nc4nix is more performant when not using this change, and instead leaving the hash-calculation to stdlib's sha256.Sum256.

@onny
Copy link
Contributor Author

onny commented Feb 19, 2024

To me this change looks like it's switching to the new hash representation used by nix which additionally allows for different hashing algorithms (e.g. sha1, .. instead of sha256). i.e., it's not changing the hash, it's merely using a different encoding of it.

@Conni2461 @dasJ what do you think? nc4nix is more performant when not using this change, and instead leaving the hash-calculation to stdlib's sha256.Sum256.

sha256.Sum256 only hashes the zip file whereas this PR calculates the hash by unpacking the zip and calculating the hash recursively over all containing files, see:

$ nix-prefetch-url --unpack "https://github.com/nextcloud/bookmarks/releases/download/v13.1.3/bookmarks-13.1.3.tar.gz"
06pprhlaaqdha2nmfdcf76mhh48hdr5jlv88snxji8lpflv50wr5
$ nix-prefetch-url  "https://github.com/nextcloud/bookmarks/releases/download/v13.1.3/bookmarks-13.1.3.tar.gz"
0yl1agr62y87bil321ryrl0qwp9m0gksgwhvcqqlkxgwnjs98d7n

the unpacked hash is used in fetchNextcloudApp because this function also uses fetchzip with recursive hash calculation: https://github.com/NixOS/nixpkgs/blob/791355b27c5bfc58f7339a3dafc936ec50130e01/pkgs/build-support/fetchnextcloudapp/default.nix

I'm not sure if it's possible and recommended by upstream to use the single zip file hash to package nextcloud apps

@leonklingele
Copy link
Member

sha256.Sum256 only hashes the zip file whereas this PR calculates the hash by unpacking the zip and calculating the hash recursively over all containing files

I'm not 100% fluent in Nix but I can't see a difference here from a integrity-preserving point of view. Let's see what my work mates have to say. I'll get back to you tomorrow! :)

Copy link
Member

@leonklingele leonklingele left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, this slipped!

Comment on lines +129 to +132
dname, err := os.MkdirTemp("", "")
if err != nil {
return "", fmt.Errorf("failed to create temp dir: %w", err)
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just noticed that this directory should be removed after use here, and not further down below, i.e.

Suggested change
dname, err := os.MkdirTemp("", "")
if err != nil {
return "", fmt.Errorf("failed to create temp dir: %w", err)
}
dname, err := os.MkdirTemp("", "")
if err != nil {
return "", fmt.Errorf("failed to create temp dir: %w", err)
}
defer func() {
if err := os.RemoveAll(dname); err != nil {
log.Printf("failed to clean up temp dir %q: %v", dname, err)
}
}()

if err := nar.DumpPath(h, entryPath); err != nil {
return "", fmt.Errorf("failed to dump path: %w", err)
}
defer os.RemoveAll(dname)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
defer os.RemoveAll(dname)

@leonklingele
Copy link
Member

leonklingele commented Feb 20, 2024 via email

@cheriimoya
Copy link
Contributor

I checked the output and somehow, there are some empty values. If I run rg '"sha256": ""' *.json but I just noticed, it also happens with the current implementation. Maybe those should be handled/debugged in a separate Issue.

Otherwise, the PR looks good to me and can be merged.

@cheriimoya cheriimoya merged commit ba37674 into helsinki-systems:main Mar 1, 2024
@onny
Copy link
Contributor Author

onny commented Mar 1, 2024

thank you so much for helping and merging this :)

@leonklingele
Copy link
Member

Hey @onny :) Just fyi: We have updated this again with 3c35a0e — we now no longer extract the zip archive due to bug with some of the Nextcloud apps which yielded an incorrect hash. We however still use an SRI hash.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants