Nixpkgs: buildRustPackage: cargo-vendor upgrade broke cargoSha256 hashes

[andir]

Issue description

On today's master (5036d028551754f8935458c8347bdbe158a76899) - and probably others - building the cargoDeps attribute of many buildRustPackage package produces an output that differs from the output on another architecture. Nix will display a hash mismatch. I tried with x86_64-linux and aarch64-linux.

Steps to reproduce

Execute this on aarch64 and x86_64. The aarch64 build produces the below output while x86_64 is happy with the hash in nixpkgs.

$ nix build -f https://github.com/NixOS/nixpkgs/archive/5036d028551754f8935458c8347bdbe158a76899.tar.gz rainicorn.cargoDeps
hash mismatch in fixed-output derivation '/nix/store/101dawfkl5y7da9pw4h8qvs1b0xpq7vv-rainicorn-1.0.0-vendor':
  wanted: sha256:14kd25mw6m20blqcr221cclcqxw0j229zxq8hsaay6q7jgv0c7a0
  got:    sha256:07zsj12g4ff0cdb9pwz302vxvajr8g6nl3bpz4vdyi84csfvmahz
[0 built (1 failed), 16.0 MiB DL]
error: build of '/nix/store/8dzf656w49s9nwg2q1va8i6z5qfc2jms-rainicorn-1.0.0-vendor.drv' failed

Technical details

Please run nix-shell -p nix-info --run "nix-info -m" and paste the
results.

• system: "aarch64-linux"
• host os: Linux 5.0.2, NixOS, 19.03pre-git (Koi)
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.3pre6631_e58a7144
• nixpkgs: /run/current-system/nixpkgs

and

• system: "x86_64-linux"
• host os: Linux 5.0.9, NixOS, 19.09pre177249.dfd8f84aef1 (Loris)
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.3pre6631_e58a7144
• channels(root): "nixos-19.09pre177249.dfd8f84aef1, nixos-17.09-17.09.3269.14f9ee66e63, nixos-18.03-18.03.133402.cb0e20d6db9, nixos-18.09-18.09.2532.571b40d3f50, nixos-19.03-19.03.172361.cf3e277dd0b, nixos-unstable-19.09pre177249.dfd8f84aef1"
• channels(andi): ""
• nixpkgs: /nix/var/nix/profiles/per-user/root/channels/nixos

[dywedir]

x86_64 build produces same output for me:

hash mismatch in fixed-output derivation '/nix/store/101dawfkl5y7da9pw4h8qvs1b0xpq7vv-rainicorn-1.0.0-vendor':
  wanted: sha256:14kd25mw6m20blqcr221cclcqxw0j229zxq8hsaay6q7jgv0c7a0
  got:    sha256:07zsj12g4ff0cdb9pwz302vxvajr8g6nl3bpz4vdyi84csfvmahz
[0 built (1 failed)]
error: build of '/nix/store/4xrqi96dq60143cb8swsmlp00dd265ks-rainicorn-1.0.0-vendor.drv' failed

---

• system: "x86_64-linux"
• host os: Linux 5.0.9, NixOS, 19.09pre177249.dfd8f84aef1 (Loris)
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.2.2
• channels(root): "nixos-19.09pre177249.dfd8f84aef1"
• nixpkgs: /nix/var/nix/profiles/per-user/root/channels/nixos

[matthewbauer]

I noticed something similar on macOS in https://github.com/NixOS/nixpkgs/pull/60561. Could some recent change have caused this? Perhaps https://github.com/NixOS/nixpkgs/pull/57017 ?

[andir]

I reverted #57017 in a branch on my fork. My x86_64-linux laptop doesn't complain about the hash sum - as before. The aarch64-linux community box also doesn't complain anymore. Can anyone else confirm this?

$ git clone https://github.com/andir/nixpkgs.git -b rust-hashmismatch --depth 1 test
$ cd test
$ nix-build -A rainicorn.cargoDeps --check
$ nix-build -A rust-cbindgen.cargoDeps --check

[andir]

I just made a diff of rainicorn.cargoDeps:
https://s.h4ck.space/523cccf073d06304e2936e58f95fa8d887293942-rainicorn-vendor-diff.html

The left side is aarch64, the right side is x86_64. Both are done on the same git revision (523cccf073d06304e2936e58f95fa8d887293942).

[Mic92]

What a weird behavior that .travis.yml is missing.

[dywedir]

Probably related: https://github.com/alexcrichton/cargo-vendor/commit/d019f1b93a77889659e47f247520368907e8fc48

[danieldk]

I think this may be related: I also see different hashes on NixOS 19.03 vs. stable. I use the master branch, but when CI builds the derivation on 19.03, the hashes do not match. If I build on NixOS 19.03 with buildRustPackage from master, the hashes do match.

This is quite annoying, because it makes it impossible to have package sets that work on NixOS stable and unstable without using rustPlatform from a nixpkgs newer than 19.03. I'll try to revert #57017 and see if I get the same hashes on 19.03 and master.

[danieldk]

That's indeed it. When I revert #57017, I get the same cargoSha256 as 19.03.

Maybe this change should be reverted? Since NixOS is not a rolling distribution and people run both stable and unstable, it would really be nice if package sets and overlays work on both versions. This also makes backporting changes easier.

[danieldk]

Diff between the vendored dependencies:

https://gist.github.com/danieldk/52fff7bfb90a5bdbe7e914b0b37bda9d

Here the differences also seem to be missing dotfiles (e.g. .travis.yml and .cargo_vcs_info.json). I think this is the vendor upstream PR that changed this behavior:

https://github.com/alexcrichton/cargo-vendor/issues/137

(Edit: oops, I just saw that @dywedir already mentioned the associated commit.)

[lilyball]

57017 is a critical update and reverting it will break multiple Rust packages.

Rather I think we should get that change pushed into the nixos-stable channel, and then update any Rust packages whose cargoSha256 changes as a result.

[Mic92]

The only bummer is that it also breaks people's own packages on the channel as well.

[danieldk]

Yeah, it would be bad to break people's derivations as an update to a stable release.

At any rate, the 19.09 release notes should probably have a blurb that points out that cargoSha256 hashes will change due to cargo-vendor changes, so that people who update from 19.03 to 19.09 are prepared.

There are probably also derivations in master that have incorrect hashes now, since the .cargo_vcs_info.json file that is generated by cargo package is now excluded vendored dependencies.

[alyssais]

I’ve updated the title of the issue to better reflect what I think we now know.

Additionally, I’ve opened #62047 to update the hashes for all packages that haven’t been updated in master yet. I would appreciate a review on it. Once that’s merged, I can do the same thing for the affected release branch.

[alyssais]

Looks like I misunderstood and this hasn’t made its was into a release branch yet, so we’re almost done here.

Somebody just needs to add the release note for 19.09.

[Ma27]

Somebody just needs to add the release note for 19.09.

@alyssais with the changelog PR (#62935) being merged, is there anything else missing?

[alyssais]

Don't think so. :) Somebody can shout if I'm wrong.