#78649 (recursive? #t) doesn't seem to be part of the source hash

Message #11 received at 78649@debbugs.gnu.org (full text, mbox, reply):

Received: (at 78649) by debbugs.gnu.org; 13 Jun 2025 16:13:47 +0000
From debbugs-submit-bounces@debbugs.gnu.org Fri Jun 13 12:13:47 2025
Received: from localhost ([127.0.0.1]:48638 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1uQ72D-0003mV-96
	for submit@debbugs.gnu.org; Fri, 13 Jun 2025 12:13:46 -0400
Received: from mail-wm1-x32d.google.com ([2a00:1450:4864:20::32d]:60910)
 by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)
 (Exim 4.84_2) (envelope-from <zimon.toutoune@gmail.com>)
 id 1uQ70x-0003b5-Cr
 for 78649@debbugs.gnu.org; Fri, 13 Jun 2025 12:12:41 -0400
Received: by mail-wm1-x32d.google.com with SMTP id
 5b1f17b1804b1-451dbe494d6so30114365e9.1
 for <78649@debbugs.gnu.org>; Fri, 13 Jun 2025 09:12:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1749831136; x=1750435936; darn=debbugs.gnu.org;
 h=content-transfer-encoding:mime-version:message-id:date:references
 :in-reply-to:subject:to:from:from:to:cc:subject:date:message-id
 :reply-to; bh=KNEaD5txKawu1StqV0Q8c+MXc1wlUr0xLTngUr5P9A0=;
 b=LBBBrabKWa/wtw2LuX50xENtsXhInGyqiHD6HZEpjNHsKlbYyuL0klYD1NLNI9PW1G
 K333sicqPOxWS0KhWgTG5J/suBaTDTQbe7Bqbf5XsC3X5+7SWYxaAWtocuo9AJqBb/5A
 bYC/dIrgduCY5v0u7WlLsfq5fOgXmRNIAD7VPlgTw01Svk3j6nI8T7hURY18SelIVG04
 RV+JYjbfwU5LHsVdY9Apx5cDu4ZEINcyb6CkQfe/JAqPmPZ0AzluzdWKrP68eHYrvUNE
 Cl8iycJCugj8GAHZPte++2pCZPU19Xh3q2y9S8vlpjFHajeI9KPeAFwmIk5YwxDtJDRr
 XnQQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1749831136; x=1750435936;
 h=content-transfer-encoding:mime-version:message-id:date:references
 :in-reply-to:subject:to:from:x-gm-message-state:from:to:cc:subject
 :date:message-id:reply-to;
 bh=KNEaD5txKawu1StqV0Q8c+MXc1wlUr0xLTngUr5P9A0=;
 b=knIU1gcbbIRr8RYV3tgwIiEPPW91yScDBMbUGxBRaP6HKyWiMRd7NniqHhaiFOH66G
 RfhGFO32RSXW6duDldU6WePzPh3t7G7RpzQH4NpXsp+xyTNQVM2nFH5CXJEUdXafoic8
 rpvNyAa/XhyzkCnkXwj8vzMRNyAm+kEFgCUo1hoZEDJmw2bF9X/CrYAlmYngQJF7ThPw
 EMk0ILD32MTRvC4M0upY8qR0rCk8W6IZMsDZSZpMbJQ6sGUnbijM18X4HQMUG4uv3pAq
 X11TLrCUnT/ZW36kEqGKFzhtzkOLsacbJXKS0FwhvYX09m3bosUGta9cJnk5fVZ4r1BK
 rsuw==
X-Forwarded-Encrypted: i=1;
 AJvYcCWrUhqJ0dNCvoNCdA4RvhuGd9pA5/m3BhzE7lMHanryJXqa6jn+vmcTTGLXZ002GoLxcUzFXQ==@debbugs.gnu.org
X-Gm-Message-State: AOJu0YzUV+oAlVdy324QBL/W9+rvi2jZ3d3U57MQ3SoO3mx6z6MPGn1Z
 /DfWr1I2f71kCmZo6eNRdts+L9FO51LyLFsqZTM5PfOrRC08kkKdz56KoXhq6A==
X-Gm-Gg: ASbGncuxTAT7JjzZCkzj6GMbQf8asUxCagSMQsOEUzz0+S7M6A3iEZKEl3PNgTS5j5A
 8nGhNdJCy6vB9F93ZH0hNsDqMGjW5Ci4UZ1Zz0doCGBnXAkiqfxfuGBcCHAu6ufLYO/WnhUzm0U
 6pPqHDlAOFKXyqf/lHhThSuITm/XIoi/U83BMegHkQ1x3FumH5kQENc+ws6bqFplCLzsz8XfSmA
 cTFbIb3aUoiFwFd/4S3DYNnXwfIcV6ppkvT6zy7PrVx+FgPi2aByALoWjPqZtyyAy1TExcRTEVY
 RRs2DlWUxgMrFPxNtSjpQEK96Q6QTYTYD2B9DpBjGnlpFoYWJW5JfFBsM6oCNueVGjywWLbIUdo
 7snEwsbKlD4rsG7aX/0+AHJ4=
X-Google-Smtp-Source: AGHT+IEh7dHWTPAXiN0aprinMh/jSibdtN9GqmTD3KRmx7qVs1LdarBbj1NuEEhsPnTEP2kNwJ7+fA==
X-Received: by 2002:a05:600c:8288:b0:440:6a1a:d89f with SMTP id
 5b1f17b1804b1-4533ca946e2mr2111095e9.4.1749831135847; 
 Fri, 13 Jun 2025 09:12:15 -0700 (PDT)
Received: from lili (nat-dsi-209.net.univ-paris-diderot.fr. [81.194.30.209])
 by smtp.gmail.com with ESMTPSA id
 5b1f17b1804b1-4532e184724sm55896165e9.39.2025.06.13.09.12.15
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Fri, 13 Jun 2025 09:12:15 -0700 (PDT)
From: Simon Tournier <zimon.toutoune@gmail.com>
To: "nomike (they/them)" <nomike@nomike.com>, 78649@debbugs.gnu.org
Subject: Re: bug#78649: (recursive? #t) doesn't seem to be part of the
 source hash
In-Reply-To: <331afb8a-fa7f-4935-b990-ebd6f5268b58@nomike.com>
References: <331afb8a-fa7f-4935-b990-ebd6f5268b58@nomike.com>
Date: Fri, 13 Jun 2025 17:46:56 +0200
Message-ID: <87sek3myof.fsf@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 78649
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Hi,

On Sat, 31 May 2025 at 00:56, "nomike (they/them)" <nomike@nomike.com> wrote:

> IMHO this hash should also contain flags like recursive.

The hash contains the recursive flag. :-)

As Rutherther said, the store item hash (path in /gnu/store) of the
source of a package only depends on the checksum hash.  It’s named a
fixed-output derivation.

Concretely, compare

--8<---------------cut here---------------start------------->8---
Derive
([("out","/gnu/store/dsngrwg5li7byxfr5bagn8m8yzhalw4d-megacmd-1.5.1-checkout","r:sha256","a8e5f0fca1addc3c9640605efe96ccba34084c2308b47a1bc6e2bed6bd34648b")]
 ,[]
 ,[]
 ,"x86_64-linux","builtin:git-download",[]
 ,[("commit","1.5.1_Linux")
   ,("impureEnvVars","http_proxy https_proxy LC_ALL LC_MESSAGES LANG COLUMNS")
   ,("out","/gnu/store/dsngrwg5li7byxfr5bagn8m8yzhalw4d-megacmd-1.5.1-checkout")
   ,("preferLocalBuild","1")
   ,("recursive?","#t")
   ,("url","\"https://github.com/meganz/MEGAcmd\"")])
--8<---------------cut here---------------end--------------->8---

and

--8<---------------cut here---------------start------------->8---
Derive
([("out","/gnu/store/dsngrwg5li7byxfr5bagn8m8yzhalw4d-megacmd-1.5.1-checkout","r:sha256","a8e5f0fca1addc3c9640605efe96ccba34084c2308b47a1bc6e2bed6bd34648b")]
 ,[]
 ,[]
 ,"x86_64-linux","builtin:git-download",[]
 ,[("commit","1.5.1_Linux")
   ,("impureEnvVars","http_proxy https_proxy LC_ALL LC_MESSAGES LANG COLUMNS")
   ,("out","/gnu/store/dsngrwg5li7byxfr5bagn8m8yzhalw4d-megacmd-1.5.1-checkout")
   ,("preferLocalBuild","1")
   ,("recursive?","#f")
   ,("url","\"https://github.com/meganz/MEGAcmd\"")])
--8<---------------cut here---------------end--------------->8---

One have the flag recursive set to #t and the other to #f.  But the path
/gnu/store/dsngr…-checkout is the same.  That’s because the hash
’dsngr…’ is computed using only the other hash ’a8e5f0fc…’ – which is
another representation (hex format) of the checksum integrity
(nix-base32 format):

        (sha256
         (base32
          "12v46jyxdgp2qqdpmd084d60hd5srjbgwpk082b3rp5dl7yg1rd8"))

One way to see it:

--8<---------------cut here---------------start------------->8---
$ guix hash -S nar -H sha256 -f hex $(guix build -S megacmd)
a8e5f0fca1addc3c9640605efe96ccba34084c2308b47a1bc6e2bed6bd34648b

$ guix hash -S nar -H sha256 -f nix-base32 $(guix build -S megacmd)
12v46jyxdgp2qqdpmd084d60hd5srjbgwpk082b3rp5dl7yg1rd8
--8<---------------cut here---------------end--------------->8---

Therefore, if you change the recursive flag without changing the
integrity checksum, then indeed you might have bad surprise.

An example:

--8<---------------cut here---------------start------------->8---
$ ./pre-inst-env guix build -S megacmd 
/gnu/store/dsngrwg5li7byxfr5bagn8m8yzhalw4d-megacmd-1.5.1-checkout

$ git --no-pager diff -- gnu/packages/sync.scm
diff --git a/gnu/packages/sync.scm b/gnu/packages/sync.scm
index e0369f32e13..dd45249cee3 100644
--- a/gnu/packages/sync.scm
+++ b/gnu/packages/sync.scm
@@ -231,7 +231,7 @@ (define-public megacmd
         (uri (git-reference
               (url "https://github.com/meganz/MEGAcmd")
               (commit (string-append version "_Linux"))
-              (recursive? #t)))
+              (recursive? #f)))
         (sha256
          (base32
           "12v46jyxdgp2qqdpmd084d60hd5srjbgwpk082b3rp5dl7yg1rd8"))

$ ./pre-inst-env guix build -S megacmd 
;;; note: source file /home/simon/src/guix/guix/gnu/packages/sync.scm
;;;       newer than compiled /home/simon/src/guix/guix/gnu/packages/sync.go
;;; note: source file /home/simon/src/guix/guix/gnu/packages/sync.scm
;;;       newer than compiled /home/simon/.guix-profile/lib/guile/3.0/site-ccache/gnu/packages/sync.go
/gnu/store/dsngrwg5li7byxfr5bagn8m8yzhalw4d-megacmd-1.5.1-checkout
--8<---------------cut here---------------end--------------->8---

The recursive flag might appear ineffective but it’s just because Guix
does not recompute all.  As Rutherther said: « That means it is
responsibility of the user to change the hash to a new one ». :-)

Well, you see it when using the option --check.

--8<---------------cut here---------------start------------->8---
$ ./pre-inst-env guix build -S megacmd
/gnu/store/dsngrwg5li7byxfr5bagn8m8yzhalw4d-megacmd-1.5.1-checkout

$ ./pre-inst-env guix build -S megacmd --check
The following derivation will be built:
  /gnu/store/58pgh0lqy4mw99hxhwi3wbxsaykqi3hy-megacmd-1.5.1-checkout.drv
building /gnu/store/58pgh0lqy4mw99hxhwi3wbxsaykqi3hy-megacmd-1.5.1-checkout.drv...
Initialized empty Git repository in /gnu/store/1f254hay097h781ildhp498id55mj1pf-megacmd-1.5.1-checkout/.git/
From https://github.com/meganz/MEGAcmd

[...]

HEAD is now at 7886433 Remove unneded Qt plugins
Submodule 'sdk' (https://github.com/meganz/sdk.git) registered for path 'sdk'
Cloning into '/gnu/store/1f254hay097h781ildhp498id55mj1pf-megacmd-1.5.1-checkout/sdk'...
Submodule path 'sdk': checked out 'a1d391d6a9b747892e8033d60ce1f795d181df3c'
warning: rewriting hashes in `/gnu/store/dsngrwg5li7byxfr5bagn8m8yzhalw4d-megacmd-1.5.1-checkout'; cross fingers
successfully built /gnu/store/58pgh0lqy4mw99hxhwi3wbxsaykqi3hy-megacmd-1.5.1-checkout.drv
/gnu/store/dsngrwg5li7byxfr5bagn8m8yzhalw4d-megacmd-1.5.1-checkout

$ git --no-pager diff -- gnu/packages/sync.scm
diff --git a/gnu/packages/sync.scm b/gnu/packages/sync.scm
index e0369f32e13..dd45249cee3 100644
--- a/gnu/packages/sync.scm
+++ b/gnu/packages/sync.scm
@@ -231,7 +231,7 @@ (define-public megacmd
         (uri (git-reference
               (url "https://github.com/meganz/MEGAcmd")
               (commit (string-append version "_Linux"))
-              (recursive? #t)))
+              (recursive? #f)))
         (sha256
          (base32
           "12v46jyxdgp2qqdpmd084d60hd5srjbgwpk082b3rp5dl7yg1rd8"))

$ ./pre-inst-env guix build -S megacmd --check
;;; note: source file /home/simon/src/guix/guix/gnu/packages/sync.scm
;;;       newer than compiled /home/simon/src/guix/guix/gnu/packages/sync.go
;;; note: source file /home/simon/src/guix/guix/gnu/packages/sync.scm
;;;       newer than compiled /home/simon/.guix-profile/lib/guile/3.0/site-ccache/gnu/packages/sync.go
The following derivation will be built:
  /gnu/store/h8kbb614pqm0385mhvwa54bszssx2wid-megacmd-1.5.1-checkout.drv
building /gnu/store/h8kbb614pqm0385mhvwa54bszssx2wid-megacmd-1.5.1-checkout.drv...
Initialized empty Git repository in /gnu/store/1krjpms2pwp1p4269fg3jzdpg3p45h8h-megacmd-1.5.1-checkout/.git/
From https://github.com/meganz/MEGAcmd

[...]

HEAD is now at 7886433 Remove unneded Qt plugins
warning: rewriting hashes in `/gnu/store/dsngrwg5li7byxfr5bagn8m8yzhalw4d-megacmd-1.5.1-checkout'; cross fingers
r:sha256 hash mismatch for /gnu/store/dsngrwg5li7byxfr5bagn8m8yzhalw4d-megacmd-1.5.1-checkout:
  expected hash: 12v46jyxdgp2qqdpmd084d60hd5srjbgwpk082b3rp5dl7yg1rd8
  actual hash:   0in141v0lqgy5ywi00c8bg0c7yisxrnmmfyafc5gam0dl21wybvj
hash mismatch for store item '/gnu/store/dsngrwg5li7byxfr5bagn8m8yzhalw4d-megacmd-1.5.1-checkout'
build of /gnu/store/h8kbb614pqm0385mhvwa54bszssx2wid-megacmd-1.5.1-checkout.drv failed
Could not find build log for '/gnu/store/h8kbb614pqm0385mhvwa54bszssx2wid-megacmd-1.5.1-checkout.drv'.
guix build: error: build of `/gnu/store/h8kbb614pqm0385mhvwa54bszssx2wid-megacmd-1.5.1-checkout.drv' failed
--8<---------------cut here---------------end--------------->8---

As you see with the line:

    Submodule path 'sdk': checked out 'a1d391d6a9b747892e8033d60ce1f795d181df3c'

it runs “git clone --recurse-submodules”. :-)

For example, if you have another package inheriting ’megacmd’ but
setting the recursive flag to #f

        $ git --no-pager diff -- gnu/packages/sync.scm
        diff --git a/gnu/packages/sync.scm b/gnu/packages/sync.scm
        index e0369f32e13..4b1a8d34074 100644
        --- a/gnu/packages/sync.scm
        +++ b/gnu/packages/sync.scm
        @@ -269,6 +269,23 @@ (define-public megacmd
         distributions.")
             (license (list license:bsd-2 license:gpl3+))))

        +(define-public megacmd-bis
        +  (package
        +    (inherit megacmd)
        +    (name "megacmd-bis")
        +    (version "1.5.1")
        +    (source
        +     (origin
        +       (method git-fetch)
        +       (uri (git-reference
        +             (url "https://github.com/meganz/MEGAcmd")
        +             (commit (string-append version "_Linux"))
        +             (recursive? #f)))
        +       (sha256
        +        (base32
        +         "0in141v0lqgy5ywi00c8bg0c7yisxrnmmfyafc5gam0dl21wybvj"))
        +       (file-name (git-file-name name version))))))

Then, you will see that:

--8<---------------cut here---------------start------------->8---
$ ls -a $(guix build -S megacmd)/sdk/
.	    .gitlab	    CREDITS.md	 Makefile.win32  bindings      contrib	 include	m4	 tests
..	    .travis.yml     LICENSE	 README.md	 clean.sh      doc	 libmega.pc.in	patches  third_party
.gitignore  CMakeLists.txt  Makefile.am  autogen.sh	 configure.ac  examples  logo.png	src

$ ls -a $(./pre-inst-env guix build -S megacmd-bis)/sdk/
.  ..
--8<---------------cut here---------------end--------------->8---

When using the recursive flag to #t, the submodule is there and the
content is part of the integrity checksum, while the other is not.

HTH.

Cheers,
simon

Send a report that this bug log contains spam.