Secure Hash Handling and Proxy Usage in Nixpkgs Fetchers

- `bzr` - `svn` The hash is printed to stdout. 3. Prefetch by package source (with `nix-prefetch-url '<nixpkgs>' -A <package>.src`, where `<package>` is package attribute name). The hash is printed to stdout. This works well when you've upgraded the existing package version and want to find out new hash, but is useless if the package can't be accessed by attribute or the package has multiple sources (`.srcs`, architecture-dependent sources, etc). 4. Upstream hash: use it when upstream provides `sha256` or `sha512`. Don't use it when upstream provides `md5`, compute `sha256` instead. A little nuance is that `nix-prefetch-*` tools produce hashes with the `nix32` encoding (a Nix-specific base32 adaptation), but upstream usually provides hexadecimal (`base16`) encoding. Fetchers understand both formats. Nixpkgs does not standardise on any one format. You can convert between hash formats with [`nix-hash`](https://nixos.org/manual/nix/stable/command-ref/nix-hash). 5. Extract the hash from a local source archive with `sha256sum`. Use `nix-prefetch-url file:///path/to/archive` if you want the custom Nix `base32` hash. ## Obtaining hashes securely {#sec-pkgs-fetchers-secure-hashes} It's always a good idea to avoid Man-in-the-Middle (MITM) attacks when downloading source contents. Otherwise, you could unknowingly download malware instead of the intended source, and instead of the actual source hash, you'll end up using the hash of malware. Here are security considerations for this scenario: - `http://` URLs are not secure to prefetch hashes. - Upstream hashes should be obtained via a secure protocol. - `https://` URLs give you more protections when using `nix-prefetch-*` or for upstream hashes. - `https://` URLs are secure when using the [fake hash method](#sec-pkgs-fetchers-updating-source-hashes-fakehash-method) *only if* you use one of the listed fake hashes. If you use any other hash, the download will be exposed to MITM attacks even if you use HTTPS URLs. In more concrete terms, if you use any other hash, the [`--insecure` flag](https://curl.se/docs/manpage.html#-k) will be passed to the underlying call to `curl` when downloading content. ## Proxy usage {#sec-pkgs-fetchers-proxy} Nixpkgs fetchers can make use of a http(s) proxy. Each fetcher will automatically inherit proxy-related environment variables (`http_proxy`, `https_proxy`, etc) via [impureEnvVars](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-impureEnvVars). The environment variable `NIX_SSL_CERT_FILE` is also inherited in fetchers, and can be used to provide a custom certificate bundle to fetchers. This is usually required for a https proxy to work without certificate validation errors. []{#fetchurl} ## `fetchurl` {#sec-pkgs-fetchers-fetchurl} `fetchurl` returns a [fixed-output derivation](https://nixos.org/manual/nix/stable/glossary.html#gloss-fixed-output-derivation) which downloads content from a given URL and stores the unaltered contents within the Nix store. It uses {manpage}`curl(1)` internally, and allows its behaviour to be modified by specifying a few attributes in the argument to `fetchurl` (see the documentation for attributes `curlOpts`, `curlOptsList`, and `netrcPhase`). The resulting [store path](https://nixos.org/manual/nix/stable/store/store-path) is determined by the hash given to `fetchurl`, and also the `name` (or `pname` and `version`) values. If neither `name` nor `pname` and `version` are specified when calling `fetchurl`, it will default to using the [basename](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-baseNameOf) of `url` or the first element of `urls`. If `pname` and `version` are specified, `fetchurl` will use those values and will ignore `name`, even if it is also specified. ### Inputs {#sec-pkgs-fetchers-fetchurl-inputs} `fetchurl` requires an attribute set with the following attributes: `url` (String; _optional_) : The URL to download from.

This section covers several methods for obtaining source hashes, including prefetching by package source, using upstream hashes, and extracting hashes from local archives. It also emphasizes the importance of obtaining hashes securely to avoid MITM attacks, highlighting the risks associated with `http://` URLs and the need for secure protocols when using upstream hashes or `https://` URLs with the fake hash method. Furthermore, it explains how Nixpkgs fetchers automatically inherit proxy-related environment variables and how to provide a custom certificate bundle for HTTPS proxies. Finally, it introduces the `fetchurl` function, which downloads content from a URL and stores it in the Nix store as a fixed-output derivation, detailing how the store path is determined and describing the required `url` input attribute.