Nix Hash - Revision history

Drupol: /* Libraries */ Add new PHP library

2025-10-19T20:50:06Z

Libraries: Add new PHP library

← Older revision		Revision as of 20:50, 19 October 2025
Line 46:		Line 46:
	* [https://gist.github.com/colemickens/27ad622adfaf8c980f3b5066b21604ba Go implementation]		* [https://gist.github.com/colemickens/27ad622adfaf8c980f3b5066b21604ba Go implementation]
	* [https://github.com/dritter/nix-hasher/blob/master/src/Hasher.php#L18-L49 PHP Implementation]		* [https://github.com/dritter/nix-hasher/blob/master/src/Hasher.php#L18-L49 PHP Implementation]
			* [https://github.com/loophp/path-hasher PHP Implementation (NAR serialization + Hash)]

	== Further reading ==		== Further reading ==

Dinhero21: replace link with more permanent version

2025-07-20T14:32:09Z

replace link with more permanent version

← Older revision		Revision as of 14:32, 20 July 2025
Line 4:		Line 4:
	Supported algorithms are <code>md5</code>, <code>sha1</code>, <code>sha256</code>, <code>sha512</code>, <code>BLAKE3</code>. The first two are deprecated and should not be used anymore, but you may still stumble upon them in existing code.		Supported algorithms are <code>md5</code>, <code>sha1</code>, <code>sha256</code>, <code>sha512</code>, <code>BLAKE3</code>. The first two are deprecated and should not be used anymore, but you may still stumble upon them in existing code.

	A hash – which is simply a sequence of bytes – is usually encoded in order to be representable as string. Common encodings are <code>base16</code> (commonly called "hex"), <code>base32</code> and <code>base64</code>. Note that the base32 is a [https://github.com/NixOS/nix/blob/~~master~~/src/libutil/hash.cc#~~L83~~-~~L107~~ '''custom one'''] that is not documented nor standardized in any way! If possible, use the provided hashing tools to convert hashes to it (see below). base32 is used by Nix in a lot of places because it is shorter than hex but can still safely be part of a file path (as it contains no slashes).		A hash – which is simply a sequence of bytes – is usually encoded in order to be representable as string. Common encodings are <code>base16</code> (commonly called "hex"), <code>base32</code> and <code>base64</code>. Note that the base32 is a [https://github.com/NixOS/nix/blob/c70e1433abb61012dffdcd4559ec2aa87672e15c/src/libutil/hash.cc#L91-L112 '''custom one'''] that is not documented nor standardized in any way! If possible, use the provided hashing tools to convert hashes to it (see below). base32 is used by Nix in a lot of places because it is shorter than hex but can still safely be part of a file path (as it contains no slashes).

	== Usage ==		== Usage ==

Deadbaed: added BLAKE3 to the list of supported algorithms

2025-04-11T07:44:33Z

added BLAKE3 to the list of supported algorithms

← Older revision		Revision as of 07:44, 11 April 2025
Line 2:		Line 2:
	[https://en.wikipedia.org/wiki/Cryptographic_hash_function Cryptographic hashes] play an essential role in a lot of places in the Nix ecosystem. When using a hash somewhere, two criteria are essential to do so properly: the '''algorithm''' used and the '''encoding''' (and, to some extent, ''what'' is hashed).		[https://en.wikipedia.org/wiki/Cryptographic_hash_function Cryptographic hashes] play an essential role in a lot of places in the Nix ecosystem. When using a hash somewhere, two criteria are essential to do so properly: the '''algorithm''' used and the '''encoding''' (and, to some extent, ''what'' is hashed).

	Supported algorithms are <code>md5</code>, <code>sha1</code>, <code>sha256</code>, <code>sha512</code>. The first two are deprecated and should not be used anymore, but you may still stumble upon them in existing code.		Supported algorithms are <code>md5</code>, <code>sha1</code>, <code>sha256</code>, <code>sha512</code>, <code>BLAKE3</code>. The first two are deprecated and should not be used anymore, but you may still stumble upon them in existing code.

	A hash – which is simply a sequence of bytes – is usually encoded in order to be representable as string. Common encodings are <code>base16</code> (commonly called "hex"), <code>base32</code> and <code>base64</code>. Note that the base32 is a [https://github.com/NixOS/nix/blob/master/src/libutil/hash.cc#L83-L107 '''custom one'''] that is not documented nor standardized in any way! If possible, use the provided hashing tools to convert hashes to it (see below). base32 is used by Nix in a lot of places because it is shorter than hex but can still safely be part of a file path (as it contains no slashes).		A hash – which is simply a sequence of bytes – is usually encoded in order to be representable as string. Common encodings are <code>base16</code> (commonly called "hex"), <code>base32</code> and <code>base64</code>. Note that the base32 is a [https://github.com/NixOS/nix/blob/master/src/libutil/hash.cc#L83-L107 '''custom one'''] that is not documented nor standardized in any way! If possible, use the provided hashing tools to convert hashes to it (see below). base32 is used by Nix in a lot of places because it is shorter than hex but can still safely be part of a file path (as it contains no slashes).

Eliasp: /* Tools */ add hint, how to get an SRI hash using `nix store prefetch-url`

2024-11-19T19:36:40Z

Tools: add hint, how to get an SRI hash using `nix store prefetch-url`

← Older revision		Revision as of 19:36, 19 November 2024
Line 37:		Line 37:

	When dealing with remote files, <code>nix-prefetch-url</code> offers a handy shortcut for downloading the file into the Nix store and printing out its hash. (<code>nix-prefetch-url --unpack</code> is its <code>fetchzip</code> equivalent.)		When dealing with remote files, <code>nix-prefetch-url</code> offers a handy shortcut for downloading the file into the Nix store and printing out its hash. (<code>nix-prefetch-url --unpack</code> is its <code>fetchzip</code> equivalent.)

			To get an SRI hash, which isn't supported by <code>nix-prefetch-url</code>, use <code>nix store prefetch-file https://...</code> instead.

	== Libraries ==		== Libraries ==

Artoria2e5: /* Updating Packages */ Sentence case, demote to

2024-05-15T06:37:02Z

Updating Packages: Sentence case, demote to <h3>

← Older revision		Revision as of 06:37, 15 May 2024
Line 19:		Line 19:
	The format of the hash follows the [https://www.w3.org/TR/SRI/#introduction SRI (Subresource Integrity)] specification.		The format of the hash follows the [https://www.w3.org/TR/SRI/#introduction SRI (Subresource Integrity)] specification.

	== Updating ~~Packages~~ ==		=== Updating packages ===

	[https://nixos.org/manual/nixpkgs/stable/#chap-pkgs-fetchers-caveats Using TOFU to get the new hash]		[https://nixos.org/manual/nixpkgs/stable/#chap-pkgs-fetchers-caveats Using TOFU to get the new hash]

Artoria2e5: /* What exactly is hashed */ I don't think we should paragraph-break here

2024-05-15T06:34:03Z

What exactly is hashed: I don't think we should paragraph-break here

← Older revision		Revision as of 06:34, 15 May 2024
Line 29:		Line 29:
	For <code>fetchurl</code>, the option to switch between both is called <code>recursiveHash</code> and defaults to <code>false</code>.		For <code>fetchurl</code>, the option to switch between both is called <code>recursiveHash</code> and defaults to <code>false</code>.

	<code>fetchzip</code> on the other hand will download the file, unzip it and then recursively hash the output. There's no option.		<code>fetchzip</code> on the other hand will download the file, unzip it and then recursively hash the output. There's no option. The motivation behind this is that sometimes, the content is always the same, but the archive may change. This is because zip files are inherently non-deterministic, and might be generated automatically. If they are regenerated, they'll have a different hash, although the content is the same. <code>recursiveHash</code> works around that.

	The motivation behind this is that sometimes, the content is always the same, but the archive may change. This is because zip files are inherently non-deterministic, and might be generated automatically. If they are regenerated, they'll have a different hash, although the content is the same. <code>recursiveHash</code> works around that.

	== Tools ==		== Tools ==

Artoria2e5: /* What exactly is hashed */

2024-05-15T06:31:55Z

What exactly is hashed

← Older revision		Revision as of 06:31, 15 May 2024
Line 25:		Line 25:
	== What exactly is hashed ==		== What exactly is hashed ==

	Some content can either be hashed "flat" or "recursively". "flat" (sometimes also called "file") is simply taking the hash of the file, byte by byte, and will give you the same result as for example `sha256sum -b myfile.zip`. "recursive" (or sometimes "path") hashing takes multiple files, path names and metadata (attributes) into consideration. It works by ~~NARing~~ the input before hashing.		Some content can either be hashed "flat" or "recursively". "flat" (sometimes also called "file") is simply taking the hash of the file, byte by byte, and will give you the same result as for example `sha256sum -b myfile.zip`. "recursive" (or sometimes "path") hashing takes multiple files, path names and metadata (attributes) into consideration. It works by <abbr title="nix archive (file format)">NAR</abbr>ing the input before hashing.

	For <code>fetchurl</code>, the option to switch between both is called <code>recursiveHash</code> and defaults to <code>false</code>.		For <code>fetchurl</code>, the option to switch between both is called <code>recursiveHash</code> and defaults to <code>false</code>.

Artoria2e5: /* Tools */

2024-05-15T06:29:33Z

Tools

← Older revision		Revision as of 06:29, 15 May 2024
Line 35:		Line 35:
	== Tools ==		== Tools ==

	[https://nixos.org/manual/nix/stable/command-ref/nix-hash.html nix-hash]		* [https://nixos.org/manual/nix/stable/command-ref/nix-hash.html nix-hash]
			* [https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3-hash nix hash] ([[nix command]])
	[https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3-hash nix hash]

	When dealing with remote files, <code>nix-prefetch-url</code> offers a handy shortcut for downloading the file into the Nix store and printing out its hash. (<code>nix-prefetch-url --unpack</code> is its <code>fetchzip</code> equivalent.)		When dealing with remote files, <code>nix-prefetch-url</code> offers a handy shortcut for downloading the file into the Nix store and printing out its hash. (<code>nix-prefetch-url --unpack</code> is its <code>fetchzip</code> equivalent.)

Artoria2e5: I don't believe we need a "hashes in nix" heading here. Again, sections are folded by default on mobile, so the "0th section" better has some content.

2024-05-15T06:29:07Z

I don't believe we need a "hashes in nix" heading here. Again, sections are folded by default on mobile, so the "0th section" better has some content.

← Older revision		Revision as of 06:29, 15 May 2024
Line 1:		Line 1:
	~~== Hashes in Nix ==~~

	[https://en.wikipedia.org/wiki/Cryptographic_hash_function Cryptographic hashes] play an essential role in a lot of places in the Nix ecosystem. When using a hash somewhere, two criteria are essential to do so properly: the '''algorithm''' used and the '''encoding''' (and, to some extent, ''what'' is hashed).		[https://en.wikipedia.org/wiki/Cryptographic_hash_function Cryptographic hashes] play an essential role in a lot of places in the Nix ecosystem. When using a hash somewhere, two criteria are essential to do so properly: the '''algorithm''' used and the '''encoding''' (and, to some extent, ''what'' is hashed).
Line 7:		Line 6:
	A hash – which is simply a sequence of bytes – is usually encoded in order to be representable as string. Common encodings are <code>base16</code> (commonly called "hex"), <code>base32</code> and <code>base64</code>. Note that the base32 is a [https://github.com/NixOS/nix/blob/master/src/libutil/hash.cc#L83-L107 '''custom one'''] that is not documented nor standardized in any way! If possible, use the provided hashing tools to convert hashes to it (see below). base32 is used by Nix in a lot of places because it is shorter than hex but can still safely be part of a file path (as it contains no slashes).		A hash – which is simply a sequence of bytes – is usually encoded in order to be representable as string. Common encodings are <code>base16</code> (commonly called "hex"), <code>base32</code> and <code>base64</code>. Note that the base32 is a [https://github.com/NixOS/nix/blob/master/src/libutil/hash.cc#L83-L107 '''custom one'''] that is not documented nor standardized in any way! If possible, use the provided hashing tools to convert hashes to it (see below). base32 is used by Nix in a lot of places because it is shorter than hex but can still safely be part of a file path (as it contains no slashes).

	=== Usage ===		== Usage ==

	Many derivations are so-called ''fixed-output'' derivations, meaning that you need to know and specify the hash of the output in advance. As an example, let's look at nixpkgs function <code>fetchurl</code>:		Many derivations are so-called ''fixed-output'' derivations, meaning that you need to know and specify the hash of the output in advance. As an example, let's look at nixpkgs function <code>fetchurl</code>:
Line 20:		Line 19:
	The format of the hash follows the [https://www.w3.org/TR/SRI/#introduction SRI (Subresource Integrity)] specification.		The format of the hash follows the [https://www.w3.org/TR/SRI/#introduction SRI (Subresource Integrity)] specification.

	=== Updating Packages ===		== Updating Packages ==

	[https://nixos.org/manual/nixpkgs/stable/#chap-pkgs-fetchers-caveats Using TOFU to get the new hash]		[https://nixos.org/manual/nixpkgs/stable/#chap-pkgs-fetchers-caveats Using TOFU to get the new hash]

	=== What exactly is hashed ===		== What exactly is hashed ==

	Some content can either be hashed "flat" or "recursively". "flat" (sometimes also called "file") is simply taking the hash of the file, byte by byte, and will give you the same result as for example `sha256sum -b myfile.zip`. "recursive" (or sometimes "path") hashing takes multiple files, path names and metadata (attributes) into consideration. It works by NARing the input before hashing.		Some content can either be hashed "flat" or "recursively". "flat" (sometimes also called "file") is simply taking the hash of the file, byte by byte, and will give you the same result as for example `sha256sum -b myfile.zip`. "recursive" (or sometimes "path") hashing takes multiple files, path names and metadata (attributes) into consideration. It works by NARing the input before hashing.
Line 34:		Line 33:
	The motivation behind this is that sometimes, the content is always the same, but the archive may change. This is because zip files are inherently non-deterministic, and might be generated automatically. If they are regenerated, they'll have a different hash, although the content is the same. <code>recursiveHash</code> works around that.		The motivation behind this is that sometimes, the content is always the same, but the archive may change. This is because zip files are inherently non-deterministic, and might be generated automatically. If they are regenerated, they'll have a different hash, although the content is the same. <code>recursiveHash</code> works around that.

	=== Tools ===		== Tools ==

	[https://nixos.org/manual/nix/stable/command-ref/nix-hash.html nix-hash]		[https://nixos.org/manual/nix/stable/command-ref/nix-hash.html nix-hash]
Line 42:		Line 41:
	When dealing with remote files, <code>nix-prefetch-url</code> offers a handy shortcut for downloading the file into the Nix store and printing out its hash. (<code>nix-prefetch-url --unpack</code> is its <code>fetchzip</code> equivalent.)		When dealing with remote files, <code>nix-prefetch-url</code> offers a handy shortcut for downloading the file into the Nix store and printing out its hash. (<code>nix-prefetch-url --unpack</code> is its <code>fetchzip</code> equivalent.)

	=== Libraries ===		== Libraries ==

	* [https://github.com/NixOS/nix/blob/master/src/libutil/hash.cc#L83 Original C++ implementation]		* [https://github.com/NixOS/nix/blob/master/src/libutil/hash.cc#L83 Original C++ implementation]

imported>Goorzhel: Explain SRI, which I had to Google to decode

2023-11-29T06:24:03Z

Explain SRI, which I had to Google to decode

← Older revision		Revision as of 06:24, 29 November 2023
Line 17:		Line 17:
	};		};
	</syntaxHighlight>		</syntaxHighlight>

			The format of the hash follows the [https://www.w3.org/TR/SRI/#introduction SRI (Subresource Integrity)] specification.

	=== Updating Packages ===		=== Updating Packages ===