Command-line option to store base16 hashes in sources.json
ericswanson-dfinity opened this issue · comments
Request: add a command-line option to make niv store base16 hashes in sources.json, rather than base32.
niv stores base32 hashes in sources.json. One property of base32 hashes is that they can't be directly compared with the base16 hashes output by commonly-used tools that generate sha256 hashes, for example sha256sum or shasum -a 256. According to https://nixos.wiki/wiki/Nix_Hash, it's also allowed to specify hashes in base16.
An example use case: We're trying to make it possible for external developers to build https://github.com/dfinity/sdk without needing to install nix. Our CI will still build using nix, so sources.json will continue to specify the URLs and sha256 hashes for several of the needed components. We'd like to make a simple bash script that downloads those components and repackages them in the expected format for local builds, and we'd like to verify the hashes. If we had a way to ask niv to store base16 hashes rather than base32 hashes, then the script could trivially compare the hashes, rather than needing to also convert between hash formats.
Hi Eric,
I'm hesitant to recommend adding this feature right now. There would need to be interest from more than 1 projects. Keeping things simple is valuable for a somewhat small project like niv.
However, niv should handle manual update to sources.json. Knowing that, you could wrap niv in your project to add a post-processing step that would change the sources file like you want.
Let me know if you want me to elaborate about this suggestion.
generate sha256 hashes, for example sha256sum or shasum -a 256
Nix hashes are nar hashes which are not (always) compatible to shasum hashes.