*: sha256 = sha256-.. => hash = sha256-..

[mkg20001]

This commit replaces all hashes using the new format
and the old variable name (sha256 = "sha256-..") to
the new format (hash = "sha256-..")

Command used for changes

find -iname "*.nix" -type f -exec sed 's|sha256 = "sha256|hash = "sha256|g' -i {} +

//cc @worldofpeace

Motivation for this change

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[SuperSandro2000]

This breaks easy updates for people not using sri hashes.

[stigtsp]

Hi! The update script expects to find and update sha256. I suggest keeping sha256 for the two derivations in pkgs/top-level/perl-packages.nix if that's ok?

[stigtsp]

Suggested change

	hash = "sha256-P7UYhZd7hiGKiepC84yvvOWCO/SPqqLRhaGGwqNYNmw=";
	sha256 = "sha256-P7UYhZd7hiGKiepC84yvvOWCO/SPqqLRhaGGwqNYNmw=";

[stigtsp]

Suggested change

	hash = "sha256-UQWF85pJFszV+o1UXpYXnJHq9vx8l6QBp1aOhBFi+l8=";
	sha256 = "sha256-UQWF85pJFszV+o1UXpYXnJHq9vx8l6QBp1aOhBFi+l8=";

[mkg20001]

@SuperSandro2000 I suppose this PR might possibly be the right time to resolve those issues beforehand and then merge it. I'd say SRI is the future, so we shouldn't let that hold things back.

[SuperSandro2000]

This should be done in badges or we can't review it and get frequent merge conflicts. Also right now it does not even eval and what do we do with all the hashes in the old format? If they are recalculated it definitely needs to be done in batches. Does this cause rebuilds? Is there a consensus on this? What do we do with PRs that introduce the old format?

[worldofpeace]

Anyone can do nix to-sri --type sha256 0f7xysk0cl48q7i28m25hasmrp30grgm3kah0s7xmkjgm33887pi @SuperSandro2000

[jonringer]

Anyone can do nix to-sri --type sha256 0f7xysk0cl48q7i28m25hasmrp30grgm3kah0s7xmkjgm33887pi @SuperSandro2000

Yea, but it's not a good user experience. At the very least I don't think we should be requesting changes to PR because they have a sha256 = <base32 hash>;.

Once 2.4 is stable, then the changes will mostly be sha256 -> hash, as the sri hash will be default.

[jtojnar]

Also fetchpatch and fetchgit (therefore also fetchFromGitHub with submodules) do not support hash yet: #79987

[vcunat]

Honestly I fail to see motivation why replace all the hashes.

[jtojnar]

I think standardization on a single format is a good idea to reduce the number of things new users need to learn about but it is simply too soon.

We need to decide if the attribute name should be narHash, hash, or integrity first, and then add support for it to fetchpatch and fetchgit. Only then we will be able to gradually migrate to the new attribute.