"hash mismatch in fixed-output derivation" when building from tar

[leana8959]

Hello,

I would like to build a Dune package from source using the fetcher pkgs.fetchurl, here's my flake:

{
  inputs = {
    opam-nix.url = "github:tweag/opam-nix";
    flake-utils.url = "github:numtide/flake-utils";
    nixpkgs.follows = "opam-nix/nixpkgs";
  };

  outputs = {
    self,
    flake-utils,
    opam-nix,
    nixpkgs,
  }: let
    package = "necrolib";
  in
    flake-utils.lib.eachDefaultSystem (system: let
      # works, master branch
      # src = pkgs.fetchurl {
      #   url = "https://gitlab.inria.fr/skeletons/necro/-/archive/master/necro-master.tar";
      #   hash = "sha256-4x4HXV2Uwt9QcFDXwvGE4Uw6opTL6Rh6jPlydMvVq+0=";
      # };
      
      # won't work, v0.14.7.1
      src = pkgs.fetchurl {
        url = "https://gitlab.inria.fr/skeletons/necro/-/archive/v0.14.7.1/necro-v0.14.7.1.tar";
        hash = "sha256-mCTLxsP7H8xTqK4OpaUYdF4lmV5TawWZgBpeWENxIg8=";
      };

      pkgs = nixpkgs.legacyPackages.${system};
      on = opam-nix.lib.${system};

      devPackagesQuery = {
        ocaml-lsp-server = "*";
        ocamlformat = "*";
      };

      query =
        devPackagesQuery
        // {
          ocaml-base-compiler = "4.14.1";
        };

      scope = on.buildDuneProject {} package src query;

      overlay = final: prev: {
        # Your overrides go here
      };
    in {
      legacyPackages = scope.overrideScope' overlay;

      packages.default = self.legacyPackages.${system}.${package};
    });
}

The problem is that, if I don't use the latest archive (master branch), nix build would fail and show the following message:

warning: Git tree '/home/leana/repos/skeletons/necro' is dirty
error: hash mismatch in fixed-output derivation '/nix/store/ach22qj94lbdb2v6srd9bipi4hl8c1m9-necro-v0.14.7.1.tar.gz.drv':
         specified: md5-7nDWUqf5UYEjZ0grdJeIXA==
            got:    md5-cXsX/ExqLxmb4jsgejzLQQ==
error: 1 dependencies of derivation '/nix/store/gmf1cd6yybhvqiwiw1f7hbdd5r040siq-necrolib-0.14.7.1.drv' failed to build

Building the master branch is completely fine. It won't build actually, see the following update.

What could be the reason behind this ? Thank you !

[leana8959]

I discovered this curious behaviour

$
direnv: loading ~/playground/necrolib_flake/.envrc
direnv: using flake
warning: Git tree '/Users/leana/playground/necrolib_flake' is dirty
error: hash mismatch in fixed-output derivation '/nix/store/ynkxx9z2v0hykbhnxdryg6acx9gr5da0-necro-v0.14.7.1.tar.gz.drv':
         specified: md5-7nDWUqf5UYEjZ0grdJeIXA==
            got:    md5-cXsX/ExqLxmb4jsgejzLQQ==
error: 1 dependencies of derivation '/nix/store/lbsz6x9si4hw9236m9xjyrfyw3qrwgfm-necrolib-0.14.7.1-env.drv' failed to build
realpath: /Users/leana/playground/necrolib_flake/.direnv/flake-profile.67688: No such file or directory
error: path '/Users/leana/playground/necrolib_flake' is not in the Nix store
warning: Git tree '/Users/leana/playground/necrolib_flake' is dirty
direnv: nix-direnv: renewed cache
direnv: export +XDG_DATA_DIRS ~PATH

~/playground/necrolib_flake
$ direnv allow
direnv: loading ~/playground/necrolib_flake/.envrc
direnv: using flake
warning: Git tree '/Users/leana/playground/necrolib_flake' is dirty
error: hash mismatch in fixed-output derivation '/nix/store/3k1wfc311v2dwwvhrfy59fv7w09jncph-necro-v0.14.8.tar.gz.drv':
         specified: md5-cXsX/ExqLxmb4jsgejzLQQ==
            got:    md5-BuCAVcZSWZJKB3VZT/eHoA==
error: 1 dependencies of derivation '/nix/store/x0dfbskrix2wy00gqiklmh4w9xzli21y-necrolib-0.14.8-env.drv' failed to build
realpath: /Users/leana/playground/necrolib_flake/.direnv/flake-profile.67798: No such file or directory
error: path '/Users/leana/playground/necrolib_flake' is not in the Nix store
warning: Git tree '/Users/leana/playground/necrolib_flake' is dirty
direnv: nix-direnv: renewed cache
direnv: export +XDG_DATA_DIRS ~PATH

That when I switch branches (clone tars of different branches), I see that there are two exact same hashes, one in "specified", one in "got". But these two are not of the same version. (The one ending in "LQQ")

[balsoft]

The reason is here: https://gitlab.inria.fr/skeletons/necro/-/blob/master/necrolib.opam.template?ref_type=heads#L3

They hardcode both the version and the md5 of the very code you're trying to build.

I think the best solution would be to manually override the src of your derivation and pass it the very source you pass to buildOpamProject.

[leana8959]

Thank you for your reply !

It worked ! Do you mind explaining why I need to override the src while it's already being passed to buildDuneProject ?

Thanks a lot !

[balsoft]

The reason is that opam-nix parses that opam file and fetches the source listed there instead of using the source from which the package was taken. I'll take a look at whether or not this is a bug.