Hash Mismatch in Skopeo Patch

[jokatzke]

Since roughly four to five hours ago, the sha256-sum of the patch applied to skopeo appears to have changed from sha256-dKEObfZY2fdsza/kObCLhv4l2snuzAbpDi4fGmtTPUQ= to sha256-1Tj9D+ePjGL5u04aT7zr5rJw4vHAVrXAsr4owdooC/Y=, causing any subsequent build to fail.

For reference, this is where the patch is being pulled:

nix2container/default.nix

Lines 31 to 48 in 3853e5c

	preBuild = let
	patch = pkgs.fetchurl {
	url = "https://github.com/nlewo/image/commit/c2254c998433cf02af60bf0292042bd80b96a77e.patch";
	sha256 = "sha256-dKEObfZY2fdsza/kObCLhv4l2snuzAbpDi4fGmtTPUQ=";
	};
	in ''
	mkdir -p vendor/github.com/nlewo/nix2container/
	cp -r ${nix2container-bin.src}/* vendor/github.com/nlewo/nix2container/
	cd vendor/github.com/containers/image/v5
	mkdir nix/
	touch nix/transport.go
	# The patch for alltransports.go does not apply cleanly to skopeo > 1.14,
	# filter the patch and insert the import manually here instead.
	filterdiff -x '*/alltransports.go' ${patch} | patch -p1
	sed -i '\#_ "github.com/containers/image/v5/tarball"#a _ "github.com/containers/image/v5/nix"' transports/alltransports/alltransports.go
	cd -
	'';

I found it kind of difficult to try to force Nix to re-fetch the patch, so I just created an overlay:

(final: prev: {
  skopeo-patch = final.fetchurl {
    url = "https://github.com/nlewo/image/commit/c2254c998433cf02af60bf0292042bd80b96a77e.patch";
    sha256 = "sha256-dKEObfZY2fdsza/kObCLhv4l2snuzAbpDi4fGmtTPUQ=";

  };
})

I tried building the patch on revisions 3cddaded2282a7806229af1c5bef222ef0143833 (nixpkgs-unstable), a6292e34000dc93d43bccf78338770c1c5ec8a99 (nixpkgs-unstable), and 2527da1ef492c495d5391f3bcf9c1dd9f4514e32 (nixos-24.05) of nixpkgs, all of which failed with the exact same error and resulting sha256-sum.

[chasecaleb]

I'm encountering this as well without about the same timing. Do you know if there's a way to work around this from a flake that pulls in nix2container as an input? Trying to wrap something up at work that depends on it so this is awkward timing.

[jokatzke]

I created a fork that patches the new hash sum in: https://github.com/jokatzke/nix2container/tree/fix-hash-mismatch -- there doesn't seem to be a convenient way of overriding or patching, unfortunately.
Not sure of this is the best solution, as what changed really shouldn't have, from my understanding. But at least this kept CI running.

[nlewo]

It looks like github changed the way their patch are generated. This is the differences between the previous patch file and the current patch file:

diff c2254c998433cf02af60bf0292042bd80b96a77e.patch /nix/store/xk6z74qc073dvs1ngvk58qqby73q6yx9-c2254c998433cf02af60bf0292042bd80b96a77e.patch
18c18
< index 0000000000..46e737dc78
---
> index 000000000..46e737dc7
229c229
< index 0bae8b2599..34cf925c29 100644
---
> index 0bae8b259..34cf925c2 100644

[nlewo]

Should be fixed by #150

[nazarewk]

this is back to the old hash, see #152