yarn2nix: use sha512 by default #149834
yarn2nix: use sha512 by default #149834
Conversation
prusnak
force-pushed
the
yarn2nix-sha512
branch
2 times, most recently
from
22cbd65
to
b546960
Compare
prusnak
force-pushed
the
yarn2nix-sha512
branch
from
b546960
to
f167823
Compare
prusnak
force-pushed
the
yarn2nix-sha512
branch
from
f167823
to
c5eec7c
Compare
prusnak
force-pushed
the
yarn2nix-sha512
branch
from
c5eec7c
to
8385afe
Compare
| resolved: `${url}#${newSha512}`, | ||
| } |
There was a problem hiding this comment.
I am not sure this is supported. At least I have not seen it anywhere.
It would probably be better to use integrity: `sha512-${newSha512}`
| @@ -34,7 +34,7 @@ function getSha1(url) { | |||
| } | |||
|
|
|||
| // Object -> Object | |||
| async function fixPkgAddMissingSha1(pkg) { | |||
| async function fixPkgAddMissingSha512(pkg) { | |||
| // local dependency | |||
|
|
|||
There was a problem hiding this comment.
I would also add something like
if (pkg.integrity) {
return pkg;
}
as according to my understanding, integrity has priority over the hash in resolved.
| @@ -46,21 +46,21 @@ async function fixPkgAddMissingSha1(pkg) { | |||
| return pkg | |||
| } | |||
|
|
|||
| const [url, sha1] = pkg.resolved.split('#', 2) | |||
| const [url, sha512] = pkg.resolved.split('#', 2) | |||
There was a problem hiding this comment.
As mentioned, I am not sure if resolved field can contain anything other than sha1. Will prolly need to scour https://github.com/yarnpkg/yarn
|
|
||
| if (sha1 || url.startsWith('https://codeload.github.com')) { | ||
| if (sha512 || url.startsWith('https://codeload.github.com')) { | ||
| return pkg |
There was a problem hiding this comment.
We should probably do getSha512 if the sha1 is present.
| }; | ||
| } | ||
| { | ||
| name = "to_readable_stream___to_readable_stream_1.0.0.tgz"; | ||
| path = fetchurl { | ||
| name = "to_readable_stream___to_readable_stream_1.0.0.tgz"; | ||
| url = "https://registry.yarnpkg.com/to-readable-stream/-/to-readable-stream-1.0.0.tgz"; | ||
| sha1 = "ce0aa0c2f3df6adf852efb404a783e77c0475771"; | ||
| sha512 = "Iq25XBt6zD5npPhlLVXGFN3/gyR2/qODcKNNyTMd4vbm39HUaOiAM4PMq0eMVC/Tkxz+Zjdsc55g9yyz+Yq00Q=="; | ||
| }; | ||
| } | ||
| { | ||
| name = "to_regex_range___to_regex_range_2.1.1.tgz"; | ||
| path = fetchurl { | ||
| name = "to_regex_range___to_regex_range_2.1.1.tgz"; | ||
| url = "https://registry.yarnpkg.com/to-regex-range/-/to-regex-range-2. |
|
The resolved field always uses sha1, so some parts of this change don't make sense. With #119522 we should already use sha512 most of the time? Please also consider and test the IFD-mode of yarn2nix where we have to use what's in the yarn.lock file. |
stale
bot
added
the
2.status: stale
Motivation for this change
Things done
sandbox = trueset innix.conf? (See Nix manual)nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)nixos/doc/manual/md-to-db.shto update generated release notes