Merge changes I526cceed,Ia4e2f1fa,I22e66972,I9fbd55a9,Ifca22e44 into main

* changes: sqlite: add a Use::fromStrNullable util: implement charptr_cast tree-wide: fix a pile of lints refactor: make HashType and Base enum classes for type safety build: integrate clang-tidy into CI
2024-08-08 22:43:10 +00:00 · 2024-08-08 22:43:10 +00:00 · 757041c3e7
parent e03cd8b3a6 4ed8461cac
commit 757041c3e7
83 changed files with 552 additions and 357 deletions
--- a/flake.nix
+++ b/flake.nix
@ -282,6 +282,10 @@
          # cheaper x86_64-linux compute in CI.
          # It is clangStdenv because clang's sanitizers are nicer.
          asanBuild = self.packages.x86_64-linux.nix-clangStdenv.override {
+            # Improve caching of non-code changes by not changing the
+            # derivation name every single time, since this will never be seen
+            # by users anyway.
+            versionSuffix = "";
            sanitize = [
              "address"
              "undefined"
@ -310,6 +314,17 @@
              touch $out
            '';

+          # clang-tidy run against the Lix codebase using the Lix clang-tidy plugin
+          clang-tidy =
+            let
+              nixpkgs = nixpkgsFor.x86_64-linux.native;
+              inherit (nixpkgs) pkgs;
+            in
+            pkgs.callPackage ./package.nix {
+              versionSuffix = "";
+              lintInsteadOfBuild = true;
+            };
+
          # Make sure that nix-env still produces the exact same result
          # on a particular version of Nixpkgs.
          evalNixpkgs =
--- a/package.nix
+++ b/package.nix
@ -28,6 +28,8 @@
  libcpuid,
  libseccomp,
  libsodium,
+  lix-clang-tidy ? null,
+  llvmPackages,
  lsof,
  lowdown,
  mdbook,
@ -67,6 +69,8 @@
  # Turn compiler warnings into errors.
  werror ? false,

+  lintInsteadOfBuild ? false,
+
  # Not a real argument, just the only way to approximate let-binding some
  # stuff for argument defaults.
  __forDefaults ? {
@ -144,6 +148,7 @@ let
    (fileset.fileFilter (f: lib.strings.hasPrefix "nix-profile" f.name) ./scripts)
  ];
 in
+assert (lintInsteadOfBuild -> lix-clang-tidy != null);
 stdenv.mkDerivation (finalAttrs: {
  inherit pname version;

@ -156,12 +161,13 @@ stdenv.mkDerivation (finalAttrs: {
          topLevelBuildFiles
          functionalTestFiles
        ]
-        ++ lib.optionals (!finalAttrs.dontBuild || internalApiDocs) [
+        ++ lib.optionals (!finalAttrs.dontBuild || internalApiDocs || lintInsteadOfBuild) [
          ./doc
          ./misc
          ./src
          ./COPYING
        ]
+        ++ lib.optionals lintInsteadOfBuild [ ./.clang-tidy ]
      )
    );
  };
@ -175,7 +181,7 @@ stdenv.mkDerivation (finalAttrs: {
      "doc"
    ];

-  dontBuild = false;
+  dontBuild = lintInsteadOfBuild;

  mesonFlags =
    let
@ -190,14 +196,15 @@ stdenv.mkDerivation (finalAttrs: {
      "-Dsandbox-shell=${lib.getExe' busybox-sandbox-shell "busybox"}"
    ]
    ++ lib.optional hostPlatform.isStatic "-Denable-embedded-sandbox-shell=true"
-    ++ lib.optional (finalAttrs.dontBuild) "-Denable-build=false"
+    ++ lib.optional (finalAttrs.dontBuild && !lintInsteadOfBuild) "-Denable-build=false"
+    ++ lib.optional lintInsteadOfBuild "-Dlix-clang-tidy-checks-path=${lix-clang-tidy}/lib/liblix-clang-tidy.so"
    ++ [
      # mesonConfigurePhase automatically passes -Dauto_features=enabled,
      # so we must explicitly enable or disable features that we are not passing
      # dependencies for.
      (lib.mesonEnable "gc" enableGC)
      (lib.mesonEnable "internal-api-docs" internalApiDocs)
-      (lib.mesonBool "enable-tests" finalAttrs.finalPackage.doCheck)
+      (lib.mesonBool "enable-tests" (finalAttrs.finalPackage.doCheck || lintInsteadOfBuild))
      (lib.mesonBool "enable-docs" canRunInstalled)
      (lib.mesonBool "werror" werror)
    ]
@ -230,7 +237,13 @@ stdenv.mkDerivation (finalAttrs: {
    ]
    ++ lib.optional hostPlatform.isLinux util-linuxMinimal
    ++ lib.optional (!officialRelease && buildUnreleasedNotes) build-release-notes
-    ++ lib.optional internalApiDocs doxygen;
+    ++ lib.optional internalApiDocs doxygen
+    ++ lib.optionals lintInsteadOfBuild [
+      # required for a wrapped clang-tidy
+      llvmPackages.clang-tools
+      # required for run-clang-tidy
+      llvmPackages.clang-unwrapped
+    ];

  buildInputs =
    [
@ -257,7 +270,10 @@ stdenv.mkDerivation (finalAttrs: {
    ++ lib.optional hostPlatform.isx86_64 libcpuid
    # There have been issues building these dependencies
    ++ lib.optional (hostPlatform.canExecute buildPlatform) aws-sdk-cpp-nix
-    ++ lib.optionals (finalAttrs.dontBuild) maybePropagatedInputs;
+    ++ lib.optionals (finalAttrs.dontBuild) maybePropagatedInputs
+    # I am so sorry. This is because checkInputs are required to pass
+    # configure, but we don't actually want to *run* the checks here.
+    ++ lib.optionals lintInsteadOfBuild finalAttrs.checkInputs;

  nativeCheckInputs = [ expect ];

@ -315,7 +331,7 @@ stdenv.mkDerivation (finalAttrs: {

  enableParallelBuilding = true;

-  doCheck = canRunInstalled;
+  doCheck = canRunInstalled && !lintInsteadOfBuild;

  mesonCheckFlags = [
    "--suite=check"
@ -327,8 +343,19 @@ stdenv.mkDerivation (finalAttrs: {
  # Make sure the internal API docs are already built, because mesonInstallPhase
  # won't let us build them there. They would normally be built in buildPhase,
  # but the internal API docs are conventionally built with doBuild = false.
-  preInstall = lib.optional internalApiDocs ''
-    meson ''${mesonBuildFlags:-} compile "$installTargets"
+  preInstall =
+    (lib.optionalString internalApiDocs ''
+      meson ''${mesonBuildFlags:-} compile "$installTargets"
+    '')
+    # evil, but like above, we do not want to run an actual build phase
+    + lib.optionalString lintInsteadOfBuild ''
+      ninja clang-tidy
+    '';
+
+  installPhase = lib.optionalString lintInsteadOfBuild ''
+    runHook preInstall
+    touch $out
+    runHook postInstall
  '';

  postInstall =
@ -396,12 +423,10 @@ stdenv.mkDerivation (finalAttrs: {
        mkShell,

        bashInteractive,
-        clang-tools,
        clangbuildanalyzer,
        doxygen,
        glibcLocales,
        just,
-        llvmPackages,
        nixfmt-rfc-style,
        skopeo,
        xonsh,
@ -454,7 +479,7 @@ stdenv.mkDerivation (finalAttrs: {
            ++ [ (lib.mesonBool "enable-pch-std" stdenv.cc.isClang) ];

          packages =
-            lib.optional (stdenv.cc.isClang && hostPlatform == buildPlatform) clang-tools
+            lib.optional (stdenv.cc.isClang && hostPlatform == buildPlatform) llvmPackages.clang-tools
            ++ [
              # Why are we providing a bashInteractive? Well, when you run
              # `bash` from inside `nix develop`, say, because you are using it
--- a/perl/lib/Nix/Store.xs
+++ b/perl/lib/Nix/Store.xs
@ -77,7 +77,7 @@ SV * queryReferences(char * path)
 SV * queryPathHash(char * path)
    PPCODE:
        try {
-            auto s = store()->queryPathInfo(store()->parseStorePath(path))->narHash.to_string(Base32, true);
+            auto s = store()->queryPathInfo(store()->parseStorePath(path))->narHash.to_string(Base::Base32, true);
            XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
        } catch (Error & e) {
            croak("%s", e.what());
@ -103,7 +103,7 @@ SV * queryPathInfo(char * path, int base32)
                XPUSHs(&PL_sv_undef);
            else
                XPUSHs(sv_2mortal(newSVpv(store()->printStorePath(*info->deriver).c_str(), 0)));
-            auto s = info->narHash.to_string(base32 ? Base32 : Base16, true);
+            auto s = info->narHash.to_string(base32 ? Base::Base32 : Base::Base16, true);
            XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
            mXPUSHi(info->registrationTime);
            mXPUSHi(info->narSize);
@ -205,7 +205,7 @@ SV * hashPath(char * algo, int base32, char * path)
    PPCODE:
        try {
            Hash h = hashPath(parseHashType(algo), path).first;
-            auto s = h.to_string(base32 ? Base32 : Base16, false);
+            auto s = h.to_string(base32 ? Base::Base32 : Base::Base16, false);
            XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
        } catch (Error & e) {
            croak("%s", e.what());
@ -216,7 +216,7 @@ SV * hashFile(char * algo, int base32, char * path)
    PPCODE:
        try {
            Hash h = hashFile(parseHashType(algo), path);
-            auto s = h.to_string(base32 ? Base32 : Base16, false);
+            auto s = h.to_string(base32 ? Base::Base32 : Base::Base16, false);
            XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
        } catch (Error & e) {
            croak("%s", e.what());
@ -227,7 +227,7 @@ SV * hashString(char * algo, int base32, char * s)
    PPCODE:
        try {
            Hash h = hashString(parseHashType(algo), s);
-            auto s = h.to_string(base32 ? Base32 : Base16, false);
+            auto s = h.to_string(base32 ? Base::Base32 : Base::Base16, false);
            XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
        } catch (Error & e) {
            croak("%s", e.what());
@ -238,7 +238,7 @@ SV * convertHash(char * algo, char * s, int toBase32)
    PPCODE:
        try {
            auto h = Hash::parseAny(s, parseHashType(algo));
-            auto s = h.to_string(toBase32 ? Base32 : Base16, false);
+            auto s = h.to_string(toBase32 ? Base::Base32 : Base::Base16, false);
            XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
        } catch (Error & e) {
            croak("%s", e.what());
--- a/src/build-remote/build-remote.cc
+++ b/src/build-remote/build-remote.cc
@ -42,7 +42,7 @@ static std::string makeLockFilename(const std::string & storeUri) {
    // This avoids issues with the escaped URI being very long and causing
    // path too long errors, while also avoiding any possibility of collision
    // caused by simple truncation.
-    auto hash = hashString(HashType::htSHA256, storeUri).to_string(Base::Base32, false);
+    auto hash = hashString(HashType::SHA256, storeUri).to_string(Base::Base32, false);
    return escapeUri(storeUri).substr(0, 48) + "-" + hash.substr(0, 16);
 }

--- a/src/libcmd/cmd-profiles.cc
+++ b/src/libcmd/cmd-profiles.cc
@ -246,7 +246,7 @@ StorePath ProfileManifest::build(ref<Store> store)
    StringSink sink;
    sink << dumpPath(tempDir);

-    auto narHash = hashString(htSHA256, sink.s);
+    auto narHash = hashString(HashType::SHA256, sink.s);

    ValidPathInfo info{
        *store,
--- a/src/libcmd/repl-interacter.cc
+++ b/src/libcmd/repl-interacter.cc
@ -96,7 +96,7 @@ static int listPossibleCallback(char * s, char *** avp)
        return p;
    };

-    vp = check((char **) malloc(possible.size() * sizeof(char *)));
+    vp = check(static_cast<char **>(malloc(possible.size() * sizeof(char *))));

    for (auto & p : possible)
        vp[ac++] = check(strdup(p.c_str()));
--- a/src/libexpr/eval-cache.cc
+++ b/src/libexpr/eval-cache.cc
@ -50,7 +50,7 @@ struct AttrDb
        Path cacheDir = getCacheDir() + "/nix/eval-cache-v5";
        createDirs(cacheDir);

-        Path dbPath = cacheDir + "/" + fingerprint.to_string(Base16, false) + ".sqlite";
+        Path dbPath = cacheDir + "/" + fingerprint.to_string(Base::Base16, false) + ".sqlite";

        state->db = SQLite(dbPath);
        state->db.isCache();
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@ -21,7 +21,6 @@
 #include "flake/flakeref.hh"

 #include <algorithm>
-#include <chrono>
 #include <iostream>
 #include <sstream>
 #include <cstring>
@ -146,7 +145,7 @@ bool Value::isTrivial() const
        && internalType != tPrimOpApp
        && (internalType != tThunk
            || (dynamic_cast<ExprAttrs *>(thunk.expr)
-                && ((ExprAttrs *) thunk.expr)->dynamicAttrs.empty())
+                && (static_cast<ExprAttrs *>(thunk.expr))->dynamicAttrs.empty())
            || dynamic_cast<ExprLambda *>(thunk.expr)
            || dynamic_cast<ExprList *>(thunk.expr));
 }
--- a/src/libexpr/flake/flake.cc
+++ b/src/libexpr/flake/flake.cc
@ -937,7 +937,7 @@ Fingerprint LockedFlake::getFingerprint() const
    // FIXME: as an optimization, if the flake contains a lock file
    // and we haven't changed it, then it's sufficient to use
    // flake.sourceInfo.storePath for the fingerprint.
-    return hashString(htSHA256,
+    return hashString(HashType::SHA256,
        fmt("%s;%s;%d;%d;%s",
            flake.sourceInfo->storePath.to_string(),
            flake.lockedRef.subdir,
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@ -346,7 +346,7 @@ void prim_importNative(EvalState & state, const PosIdx pos, Value * * args, Valu
        state.error<EvalError>("could not open '%1%': %2%", path, dlerror()).debugThrow();

    dlerror();
-    ValueInitializer func = (ValueInitializer) dlsym(handle, sym.c_str());
+    ValueInitializer func = reinterpret_cast<ValueInitializer>(dlsym(handle, sym.c_str()));
    if(!func) {
        char *message = dlerror();
        if (message)
@ -1336,7 +1336,7 @@ drvName, Bindings * attrs, Value & v)
            state.error<EvalError>("derivation cannot be both content-addressed and impure")
                .atPos(v).debugThrow();

-        auto ht = parseHashTypeOpt(outputHashAlgo).value_or(htSHA256);
+        auto ht = parseHashTypeOpt(outputHashAlgo).value_or(HashType::SHA256);
        auto method = ingestionMethod.value_or(FileIngestionMethod::Recursive);

        for (auto & i : outputs) {
@ -1764,7 +1764,7 @@ static void prim_hashFile(EvalState & state, const PosIdx pos, Value * * args, V

    auto path = realisePath(state, pos, *args[1]);

-    v.mkString(hashString(*ht, path.readFile()).to_string(Base16, false));
+    v.mkString(hashString(*ht, path.readFile()).to_string(Base::Base16, false));
 }

 static RegisterPrimOp primop_hashFile({
@ -2346,7 +2346,7 @@ static void prim_path(EvalState & state, const PosIdx pos, Value * * args, Value
        else if (n == "recursive")
            method = FileIngestionMethod { state.forceBool(*attr.value, attr.pos, "while evaluating the `recursive` attribute passed to builtins.path") };
        else if (n == "sha256")
-            expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the `sha256` attribute passed to builtins.path"), htSHA256);
+            expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the `sha256` attribute passed to builtins.path"), HashType::SHA256);
        else
            state.error<EvalError>(
                "unsupported argument '%1%' to 'addPath'",
@ -2439,6 +2439,8 @@ static void prim_attrValues(EvalState & state, const PosIdx pos, Value * * args,

    state.mkList(v, args[0]->attrs->size());

+    // FIXME: this is incredibly evil, *why*
+    // NOLINTBEGIN(cppcoreguidelines-pro-type-cstyle-cast)
    unsigned int n = 0;
    for (auto & i : *args[0]->attrs)
        v.listElems()[n++] = (Value *) &i;
@ -2452,6 +2454,7 @@ static void prim_attrValues(EvalState & state, const PosIdx pos, Value * * args,

    for (unsigned int i = 0; i < n; ++i)
        v.listElems()[i] = ((Attr *) v.listElems()[i])->value;
+    // NOLINTEND(cppcoreguidelines-pro-type-cstyle-cast)
 }

 static RegisterPrimOp primop_attrValues({
@ -3861,7 +3864,7 @@ static void prim_hashString(EvalState & state, const PosIdx pos, Value * * args,
    NixStringContext context; // discarded
    auto s = state.forceString(*args[1], context, pos, "while evaluating the second argument passed to builtins.hashString");

-    v.mkString(hashString(*ht, s).to_string(Base16, false));
+    v.mkString(hashString(*ht, s).to_string(Base::Base16, false));
 }

 static RegisterPrimOp primop_hashString({
--- a/src/libexpr/primops/fetchMercurial.cc
+++ b/src/libexpr/primops/fetchMercurial.cc
@ -31,7 +31,7 @@ static void prim_fetchMercurial(EvalState & state, const PosIdx pos, Value * * a
                // be both a revision or a branch/tag name.
                auto value = state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the `rev` attribute passed to builtins.fetchMercurial");
                if (std::regex_match(value.begin(), value.end(), revRegex))
-                    rev = Hash::parseAny(value, htSHA1);
+                    rev = Hash::parseAny(value, HashType::SHA1);
                else
                    ref = value;
            }
@ -73,7 +73,7 @@ static void prim_fetchMercurial(EvalState & state, const PosIdx pos, Value * * a
        attrs2.alloc("branch").mkString(*input2.getRef());
    // Backward compatibility: set 'rev' to
    // 0000000000000000000000000000000000000000 for a dirty tree.
-    auto rev2 = input2.getRev().value_or(Hash(htSHA1));
+    auto rev2 = input2.getRev().value_or(Hash(HashType::SHA1));
    attrs2.alloc("rev").mkString(rev2.gitRev());
    attrs2.alloc("shortRev").mkString(rev2.gitRev().substr(0, 12));
    if (auto revCount = input2.getRevCount())
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@ -32,7 +32,7 @@ void emitTreeAttrs(

    auto narHash = input.getNarHash();
    assert(narHash);
-    attrs.alloc("narHash").mkString(narHash->to_string(SRI, true));
+    attrs.alloc("narHash").mkString(narHash->to_string(Base::SRI, true));

    if (input.getType() == "git")
        attrs.alloc("submodules").mkBool(
@ -45,7 +45,7 @@ void emitTreeAttrs(
            attrs.alloc("shortRev").mkString(rev->gitShortRev());
        } else if (emptyRevFallback) {
            // Backwards compat for `builtins.fetchGit`: dirty repos return an empty sha1 as rev
-            auto emptyHash = Hash(htSHA1);
+            auto emptyHash = Hash(HashType::SHA1);
            attrs.alloc("rev").mkString(emptyHash.gitRev());
            attrs.alloc("shortRev").mkString(emptyHash.gitShortRev());
        }
@ -226,7 +226,7 @@ static void fetch(EvalState & state, const PosIdx pos, Value * * args, Value & v
            if (n == "url")
                url = state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the url we should fetch");
            else if (n == "sha256")
-                expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the sha256 of the content we should fetch"), htSHA256);
+                expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the sha256 of the content we should fetch"), HashType::SHA256);
            else if (n == "name")
                name = state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the name of the content we should fetch");
            else
@ -252,7 +252,7 @@ static void fetch(EvalState & state, const PosIdx pos, Value * * args, Value & v
        state.error<EvalError>("in pure evaluation mode, '%s' requires a 'sha256' argument", who).atPos(pos).debugThrow();

    // early exit if pinned and already in the store
-    if (expectedHash && expectedHash->type == htSHA256) {
+    if (expectedHash && expectedHash->type == HashType::SHA256) {
        auto expectedPath = state.store->makeFixedOutputPath(
            name,
            FixedOutputInfo {
@ -277,13 +277,13 @@ static void fetch(EvalState & state, const PosIdx pos, Value * * args, Value & v
    if (expectedHash) {
        auto hash = unpack
            ? state.store->queryPathInfo(storePath)->narHash
-            : hashFile(htSHA256, state.store->toRealPath(storePath));
+            : hashFile(HashType::SHA256, state.store->toRealPath(storePath));
        if (hash != *expectedHash) {
            state.error<EvalError>(
                "hash mismatch in file downloaded from '%s':\n  specified: %s\n  got:       %s",
                *url,
-                expectedHash->to_string(Base32, true),
-                hash.to_string(Base32, true)
+                expectedHash->to_string(Base::Base32, true),
+                hash.to_string(Base::Base32, true)
            ).withExitStatus(102)
            .debugThrow();
        }
--- a/src/libfetchers/fetch-to-store.cc
+++ b/src/libfetchers/fetch-to-store.cc
@ -18,8 +18,8 @@ StorePath fetchToStore(

    return
        settings.readOnlyMode
-        ? store.computeStorePathForPath(name, path.path.abs(), method, htSHA256, filter2).first
-        : store.addToStore(name, path.path.abs(), method, htSHA256, filter2, repair);
+        ? store.computeStorePathForPath(name, path.path.abs(), method, HashType::SHA256, filter2).first
+        : store.addToStore(name, path.path.abs(), method, HashType::SHA256, filter2, repair);
 }


--- a/src/libfetchers/fetchers.cc
+++ b/src/libfetchers/fetchers.cc
@ -153,12 +153,12 @@ std::pair<Tree, Input> Input::fetch(ref<Store> store) const
    };

    auto narHash = store->queryPathInfo(tree.storePath)->narHash;
-    input.attrs.insert_or_assign("narHash", narHash.to_string(SRI, true));
+    input.attrs.insert_or_assign("narHash", narHash.to_string(Base::SRI, true));

    if (auto prevNarHash = getNarHash()) {
        if (narHash != *prevNarHash)
            throw Error((unsigned int) 102, "NAR hash mismatch in input '%s' (%s), expected '%s', got '%s'",
-                to_string(), tree.actualPath, prevNarHash->to_string(SRI, true), narHash.to_string(SRI, true));
+                to_string(), tree.actualPath, prevNarHash->to_string(Base::SRI, true), narHash.to_string(Base::SRI, true));
    }

    if (auto prevLastModified = getLastModified()) {
@ -240,8 +240,8 @@ std::string Input::getType() const
 std::optional<Hash> Input::getNarHash() const
 {
    if (auto s = maybeGetStrAttr(attrs, "narHash")) {
-        auto hash = s->empty() ? Hash(htSHA256) : Hash::parseSRI(*s);
-        if (hash.type != htSHA256)
+        auto hash = s->empty() ? Hash(HashType::SHA256) : Hash::parseSRI(*s);
+        if (hash.type != HashType::SHA256)
            throw UsageError("narHash must use SHA-256");
        return hash;
    }
@ -264,7 +264,7 @@ std::optional<Hash> Input::getRev() const
            hash = Hash::parseAnyPrefixed(*s);
        } catch (BadHash &e) {
            // Default to sha1 for backwards compatibility with existing flakes
-            hash = Hash::parseAny(*s, htSHA1);
+            hash = Hash::parseAny(*s, HashType::SHA1);
        }
    }

--- a/src/libfetchers/git.cc
+++ b/src/libfetchers/git.cc
@ -49,7 +49,7 @@ bool touchCacheFile(const Path & path, time_t touch_time)
 Path getCachePath(std::string_view key)
 {
    return getCacheDir() + "/nix/gitv3/" +
-        hashString(htSHA256, key).to_string(Base32, false);
+        hashString(HashType::SHA256, key).to_string(Base::Base32, false);
 }

 // Returns the name of the HEAD branch.
@ -238,7 +238,7 @@ std::pair<StorePath, Input> fetchFromWorkdir(ref<Store> store, Input & input, co
        return files.count(file);
    };

-    auto storePath = store->addToStore(input.getName(), actualPath, FileIngestionMethod::Recursive, htSHA256, filter);
+    auto storePath = store->addToStore(input.getName(), actualPath, FileIngestionMethod::Recursive, HashType::SHA256, filter);

    // FIXME: maybe we should use the timestamp of the last
    // modified dirty file?
@ -437,8 +437,8 @@ struct GitInputScheme : InputScheme

        auto checkHashType = [&](const std::optional<Hash> & hash)
        {
-            if (hash.has_value() && !(hash->type == htSHA1 || hash->type == htSHA256))
-                throw Error("Hash '%s' is not supported by Git. Supported types are sha1 and sha256.", hash->to_string(Base16, true));
+            if (hash.has_value() && !(hash->type == HashType::SHA1 || hash->type == HashType::SHA256))
+                throw Error("Hash '%s' is not supported by Git. Supported types are sha1 and sha256.", hash->to_string(Base::Base16, true));
        };

        auto getLockedAttrs = [&]()
@ -501,7 +501,7 @@ struct GitInputScheme : InputScheme

            if (!input.getRev())
                input.attrs.insert_or_assign("rev",
-                    Hash::parseAny(chomp(runProgram("git", true, { "-C", actualUrl, "--git-dir", gitDir, "rev-parse", *input.getRef() })), htSHA1).gitRev());
+                    Hash::parseAny(chomp(runProgram("git", true, { "-C", actualUrl, "--git-dir", gitDir, "rev-parse", *input.getRef() })), HashType::SHA1).gitRev());

            repoDir = actualUrl;
        } else {
@ -521,7 +521,7 @@ struct GitInputScheme : InputScheme
            }

            if (auto res = getCache()->lookup(store, unlockedAttrs)) {
-                auto rev2 = Hash::parseAny(getStrAttr(res->first, "rev"), htSHA1);
+                auto rev2 = Hash::parseAny(getStrAttr(res->first, "rev"), HashType::SHA1);
                if (!input.getRev() || input.getRev() == rev2) {
                    input.attrs.insert_or_assign("rev", rev2.gitRev());
                    return makeResult(res->first, std::move(res->second));
@ -599,7 +599,7 @@ struct GitInputScheme : InputScheme
            }

            if (!input.getRev())
-                input.attrs.insert_or_assign("rev", Hash::parseAny(chomp(readFile(localRefFile)), htSHA1).gitRev());
+                input.attrs.insert_or_assign("rev", Hash::parseAny(chomp(readFile(localRefFile)), HashType::SHA1).gitRev());

            // cache dir lock is removed at scope end; we will only use read-only operations on specific revisions in the remainder
        }
@ -695,7 +695,7 @@ struct GitInputScheme : InputScheme
            unpackTarfile(*proc.getStdout(), tmpDir);
        }

-        auto storePath = store->addToStore(name, tmpDir, FileIngestionMethod::Recursive, htSHA256, filter);
+        auto storePath = store->addToStore(name, tmpDir, FileIngestionMethod::Recursive, HashType::SHA256, filter);

        auto lastModified = std::stoull(runProgram("git", true, { "-C", repoDir, "--git-dir", gitDir, "log", "-1", "--format=%ct", "--no-show-signature", input.getRev()->gitRev() }));

--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@ -149,7 +149,7 @@ struct GitArchiveInputScheme : InputScheme
        auto path = owner + "/" + repo;
        assert(!(ref && rev));
        if (ref) path += "/" + *ref;
-        if (rev) path += "/" + rev->to_string(Base16, false);
+        if (rev) path += "/" + rev->to_string(Base::Base16, false);
        return ParsedURL {
            .scheme = type(),
            .path = path,
@ -274,7 +274,7 @@ struct GitHubInputScheme : GitArchiveInputScheme
            readFile(
                store->toRealPath(
                    downloadFile(store, url, "source", false, headers).storePath)));
-        auto rev = Hash::parseAny(std::string { json["sha"] }, htSHA1);
+        auto rev = Hash::parseAny(std::string { json["sha"] }, HashType::SHA1);
        debug("HEAD revision for '%s' is %s", url, rev.gitRev());
        return rev;
    }
@ -295,7 +295,7 @@ struct GitHubInputScheme : GitArchiveInputScheme
            : "https://api.%s/repos/%s/%s/tarball/%s";

        const auto url = fmt(urlFmt, host, getOwner(input), getRepo(input),
-            input.getRev()->to_string(Base16, false));
+            input.getRev()->to_string(Base::Base16, false));

        return DownloadUrl { url, headers };
    }
@ -347,7 +347,7 @@ struct GitLabInputScheme : GitArchiveInputScheme
                store->toRealPath(
                    downloadFile(store, url, "source", false, headers).storePath)));
        if (json.is_array() && json.size() >= 1 && json[0]["id"] != nullptr) {
-            auto rev = Hash::parseAny(std::string(json[0]["id"]), htSHA1);
+            auto rev = Hash::parseAny(std::string(json[0]["id"]), HashType::SHA1);
            debug("HEAD revision for '%s' is %s", url, rev.gitRev());
            return rev;
        } else if (json.is_array() && json.size() == 0) {
@ -367,7 +367,7 @@ struct GitLabInputScheme : GitArchiveInputScheme
        auto host = maybeGetStrAttr(input.attrs, "host").value_or("gitlab.com");
        auto url = fmt("https://%s/api/v4/projects/%s%%2F%s/repository/archive.tar.gz?sha=%s",
            host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo"),
-            input.getRev()->to_string(Base16, false));
+            input.getRev()->to_string(Base::Base16, false));

        Headers headers = makeHeadersWithAuthTokens(host);
        return DownloadUrl { url, headers };
@ -444,7 +444,7 @@ struct SourceHutInputScheme : GitArchiveInputScheme
        if(!id)
            throw BadURL("in '%d', couldn't find ref '%d'", input.to_string(), ref);

-        auto rev = Hash::parseAny(*id, htSHA1);
+        auto rev = Hash::parseAny(*id, HashType::SHA1);
        debug("HEAD revision for '%s' is %s", fmt("%s/%s", base_url, ref), rev.gitRev());
        return rev;
    }
@ -454,7 +454,7 @@ struct SourceHutInputScheme : GitArchiveInputScheme
        auto host = maybeGetStrAttr(input.attrs, "host").value_or("git.sr.ht");
        auto url = fmt("https://%s/%s/%s/archive/%s.tar.gz",
            host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo"),
-            input.getRev()->to_string(Base16, false));
+            input.getRev()->to_string(Base::Base16, false));

        Headers headers = makeHeadersWithAuthTokens(host);
        return DownloadUrl { url, headers };
--- a/src/libfetchers/indirect.cc
+++ b/src/libfetchers/indirect.cc
@ -22,14 +22,14 @@ struct IndirectInputScheme : InputScheme
        if (path.size() == 1) {
        } else if (path.size() == 2) {
            if (std::regex_match(path[1], revRegex))
-                rev = Hash::parseAny(path[1], htSHA1);
+                rev = Hash::parseAny(path[1], HashType::SHA1);
            else if (std::regex_match(path[1], refRegex))
                ref = path[1];
            else
                throw BadURL("in flake URL '%s', '%s' is not a commit hash or branch/tag name", url.url, path[1]);
        } else if (path.size() == 3) {
            ref = path[1];
-            rev = Hash::parseAny(path[2], htSHA1);
+            rev = Hash::parseAny(path[2], HashType::SHA1);
        } else
            throw BadURL("GitHub URL '%s' is invalid", url.url);

--- a/src/libfetchers/mercurial.cc
+++ b/src/libfetchers/mercurial.cc
@ -198,7 +198,7 @@ struct MercurialInputScheme : InputScheme
                    return files.count(file);
                };

-                auto storePath = store->addToStore(input.getName(), actualPath, FileIngestionMethod::Recursive, htSHA256, filter);
+                auto storePath = store->addToStore(input.getName(), actualPath, FileIngestionMethod::Recursive, HashType::SHA256, filter);

                return {std::move(storePath), input};
            }
@ -208,8 +208,8 @@ struct MercurialInputScheme : InputScheme

        auto checkHashType = [&](const std::optional<Hash> & hash)
        {
-            if (hash.has_value() && hash->type != htSHA1)
-                throw Error("Hash '%s' is not supported by Mercurial. Only sha1 is supported.", hash->to_string(Base16, true));
+            if (hash.has_value() && hash->type != HashType::SHA1)
+                throw Error("Hash '%s' is not supported by Mercurial. Only sha1 is supported.", hash->to_string(Base::Base16, true));
        };


@ -248,14 +248,14 @@ struct MercurialInputScheme : InputScheme
        });

        if (auto res = getCache()->lookup(store, unlockedAttrs)) {
-            auto rev2 = Hash::parseAny(getStrAttr(res->first, "rev"), htSHA1);
+            auto rev2 = Hash::parseAny(getStrAttr(res->first, "rev"), HashType::SHA1);
            if (!input.getRev() || input.getRev() == rev2) {
                input.attrs.insert_or_assign("rev", rev2.gitRev());
                return makeResult(res->first, std::move(res->second));
            }
        }

-        Path cacheDir = fmt("%s/nix/hg/%s", getCacheDir(), hashString(htSHA256, actualUrl).to_string(Base32, false));
+        Path cacheDir = fmt("%s/nix/hg/%s", getCacheDir(), hashString(HashType::SHA256, actualUrl).to_string(Base::Base32, false));

        /* If this is a commit hash that we already have, we don't
           have to pull again. */
@ -289,7 +289,7 @@ struct MercurialInputScheme : InputScheme
            runHg({ "log", "-R", cacheDir, "-r", revOrRef, "--template", "{node} {rev} {branch}" }));
        assert(tokens.size() == 3);

-        input.attrs.insert_or_assign("rev", Hash::parseAny(tokens[0], htSHA1).gitRev());
+        input.attrs.insert_or_assign("rev", Hash::parseAny(tokens[0], HashType::SHA1).gitRev());
        auto revCount = std::stoull(tokens[1]);
        input.attrs.insert_or_assign("ref", tokens[2]);

--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@ -72,7 +72,7 @@ DownloadFileResult downloadFile(
    } else {
        StringSink sink;
        sink << dumpString(res.data);
-        auto hash = hashString(htSHA256, res.data);
+        auto hash = hashString(HashType::SHA256, res.data);
        ValidPathInfo info {
            *store,
            name,
@ -81,7 +81,7 @@ DownloadFileResult downloadFile(
                .hash = hash,
                .references = {},
            },
-            hashString(htSHA256, sink.s),
+            hashString(HashType::SHA256, sink.s),
        };
        info.narSize = sink.s.size();
        auto source = StringSource { sink.s };
@ -155,7 +155,7 @@ DownloadTarballResult downloadTarball(
            throw nix::Error("tarball '%s' contains an unexpected number of top-level files", url);
        auto topDir = tmpDir + "/" + members.begin()->name;
        lastModified = lstat(topDir).st_mtime;
-        unpackedStorePath = store->addToStore(name, topDir, FileIngestionMethod::Recursive, htSHA256, defaultPathFilter, NoRepair);
+        unpackedStorePath = store->addToStore(name, topDir, FileIngestionMethod::Recursive, HashType::SHA256, defaultPathFilter, NoRepair);
    }

    Attrs infoAttrs({
@ -238,7 +238,7 @@ struct CurlInputScheme : InputScheme
        // NAR hashes are preferred over file hashes since tar/zip
        // files don't have a canonical representation.
        if (auto narHash = input.getNarHash())
-            url.query.insert_or_assign("narHash", narHash->to_string(SRI, true));
+            url.query.insert_or_assign("narHash", narHash->to_string(Base::SRI, true));
        return url;
    }

--- a/src/libmain/stack.cc
+++ b/src/libmain/stack.cc
@ -2,8 +2,6 @@
 #include "shared.hh"

 #include <cstring>
-#include <cstddef>
-#include <cstdlib>

 #include <unistd.h>
 #include <signal.h>
@ -17,17 +15,17 @@ static void sigsegvHandler(int signo, siginfo_t * info, void * ctx)
       the stack pointer.  Unfortunately, getting the stack pointer is
       not portable. */
    bool haveSP = true;
-    char * sp = 0;
+    int64_t sp = 0;
 #if defined(__x86_64__) && defined(REG_RSP)
-    sp = (char *) ((ucontext_t *) ctx)->uc_mcontext.gregs[REG_RSP];
+    sp = static_cast<ucontext_t *>(ctx)->uc_mcontext.gregs[REG_RSP];
 #elif defined(REG_ESP)
-    sp = (char *) ((ucontext_t *) ctx)->uc_mcontext.gregs[REG_ESP];
+    sp = static_cast<ucontext_t *>(ctx)->uc_mcontext.gregs[REG_ESP];
 #else
    haveSP = false;
 #endif

    if (haveSP) {
-        ptrdiff_t diff = (char *) info->si_addr - sp;
+        int64_t diff = int64_t(info->si_addr) - sp;
        if (diff < 0) diff = -diff;
        if (diff < 4096) {
            nix::stackOverflowHandler(info, ctx);
--- a/src/libstore/binary-cache-store.cc
+++ b/src/libstore/binary-cache-store.cc
@ -3,17 +3,15 @@
 #include "compression.hh"
 #include "derivations.hh"
 #include "fs-accessor.hh"
-#include "globals.hh"
 #include "nar-info.hh"
 #include "sync.hh"
 #include "remote-fs-accessor.hh"
-#include "nar-info-disk-cache.hh"
+#include "nar-info-disk-cache.hh" // IWYU pragma: keep
 #include "nar-accessor.hh"
 #include "thread-pool.hh"
 #include "signals.hh"

 #include <chrono>
-#include <future>
 #include <regex>
 #include <fstream>
 #include <sstream>
@ -128,9 +126,9 @@ ref<const ValidPathInfo> BinaryCacheStore::addToStoreCommon(
    /* Read the NAR simultaneously into a CompressionSink+FileSink (to
       write the compressed NAR to disk), into a HashSink (to get the
       NAR hash), and into a NarAccessor (to get the NAR listing). */
-    HashSink fileHashSink { htSHA256 };
+    HashSink fileHashSink { HashType::SHA256 };
    std::shared_ptr<FSAccessor> narAccessor;
-    HashSink narHashSink { htSHA256 };
+    HashSink narHashSink { HashType::SHA256 };
    {
    FdSink fileSink(fdTemp.get());
    TeeSink teeSinkCompressed { fileSink, fileHashSink };
@ -150,7 +148,7 @@ ref<const ValidPathInfo> BinaryCacheStore::addToStoreCommon(
    auto [fileHash, fileSize] = fileHashSink.finish();
    narInfo->fileHash = fileHash;
    narInfo->fileSize = fileSize;
-    narInfo->url = "nar/" + narInfo->fileHash->to_string(Base32, false) + ".nar"
+    narInfo->url = "nar/" + narInfo->fileHash->to_string(Base::Base32, false) + ".nar"
        + (compression == "xz" ? ".xz" :
           compression == "bzip2" ? ".bz2" :
           compression == "zstd" ? ".zst" :
@ -288,7 +286,7 @@ void BinaryCacheStore::addToStore(const ValidPathInfo & info, Source & narSource
 StorePath BinaryCacheStore::addToStoreFromDump(Source & dump, std::string_view name,
    FileIngestionMethod method, HashType hashAlgo, RepairFlag repair, const StorePathSet & references)
 {
-    if (method != FileIngestionMethod::Recursive || hashAlgo != htSHA256)
+    if (method != FileIngestionMethod::Recursive || hashAlgo != HashType::SHA256)
        unsupported("addToStoreFromDump");
    return addToStoreCommon(dump, repair, CheckSigs, [&](HashResult nar) {
        ValidPathInfo info {
@ -425,7 +423,7 @@ StorePath BinaryCacheStore::addTextToStore(
    const StorePathSet & references,
    RepairFlag repair)
 {
-    auto textHash = hashString(htSHA256, s);
+    auto textHash = hashString(HashType::SHA256, s);
    auto path = makeTextPath(name, TextInfo { { textHash }, references });

    if (!repair && isValidPath(path))
@ -480,7 +478,8 @@ void BinaryCacheStore::addSignatures(const StorePath & storePath, const StringSe
       when addSignatures() is called sequentially on a path, because
       S3 might return an outdated cached version. */

-    auto narInfo = make_ref<NarInfo>((NarInfo &) *queryPathInfo(storePath));
+    // downcast: BinaryCacheStore always returns NarInfo from queryPathInfoUncached, making it sound
+    auto narInfo = make_ref<NarInfo>(dynamic_cast<NarInfo const &>(*queryPathInfo(storePath)));

    narInfo->sigs.insert(sigs.begin(), sigs.end());

--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@ -817,8 +817,8 @@ void LocalDerivationGoal::initTmpDir() {
            if (passAsFile.find(i.first) == passAsFile.end()) {
                env[i.first] = i.second;
            } else {
-                auto hash = hashString(htSHA256, i.first);
-                std::string fn = ".attr-" + hash.to_string(Base32, false);
+                auto hash = hashString(HashType::SHA256, i.first);
+                std::string fn = ".attr-" + hash.to_string(Base::Base32, false);
                Path p = tmpDir + "/" + fn;
                writeFile(p, rewriteStrings(i.second, inputRewrites));
                chownToBuilder(p);
@ -1225,7 +1225,7 @@ void LocalDerivationGoal::startDaemon()
            socklen_t remoteAddrLen = sizeof(remoteAddr);

            AutoCloseFD remote{accept(daemonSocket.get(),
-                (struct sockaddr *) &remoteAddr, &remoteAddrLen)};
+                reinterpret_cast<struct sockaddr *>(&remoteAddr), &remoteAddrLen)};
            if (!remote) {
                if (errno == EINTR || errno == EAGAIN) continue;
                if (errno == EINVAL || errno == ECONNABORTED) break;
@ -2146,7 +2146,7 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
                               std::string(newInfo0.path.hashPart())}});
            }

-            HashResult narHashAndSize = hashPath(htSHA256, actualPath);
+            HashResult narHashAndSize = hashPath(HashType::SHA256, actualPath);
            newInfo0.narHash = narHashAndSize.first;
            newInfo0.narSize = narHashAndSize.second;

@ -2166,7 +2166,7 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
                        std::string { scratchPath->hashPart() },
                        std::string { requiredFinalPath.hashPart() });
                rewriteOutput(outputRewrites);
-                auto narHashAndSize = hashPath(htSHA256, actualPath);
+                auto narHashAndSize = hashPath(HashType::SHA256, actualPath);
                ValidPathInfo newInfo0 { requiredFinalPath, narHashAndSize.first };
                newInfo0.narSize = narHashAndSize.second;
                auto refs = rewriteRefs();
@ -2203,8 +2203,8 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
                        BuildError("hash mismatch in fixed-output derivation '%s':\n likely URL: %s\n  specified: %s\n     got:    %s",
                            worker.store.printStorePath(drvPath),
                            guessedUrl,
-                            wanted.to_string(SRI, true),
-                            got.to_string(SRI, true)));
+                            wanted.to_string(Base::SRI, true),
+                            got.to_string(Base::SRI, true)));
                }
                if (!newInfo0.references.empty())
                    delayedException = std::make_exception_ptr(
@ -2607,7 +2607,7 @@ StorePath LocalDerivationGoal::makeFallbackPath(OutputNameView outputName)
 {
    return worker.store.makeStorePath(
        "rewrite:" + std::string(drvPath.to_string()) + ":name:" + std::string(outputName),
-        Hash(htSHA256), outputPathName(drv->name, outputName));
+        Hash(HashType::SHA256), outputPathName(drv->name, outputName));
 }


@ -2615,7 +2615,7 @@ StorePath LocalDerivationGoal::makeFallbackPath(const StorePath & path)
 {
    return worker.store.makeStorePath(
        "rewrite:" + std::string(drvPath.to_string()) + ":" + std::string(path.to_string()),
-        Hash(htSHA256), path.name());
+        Hash(HashType::SHA256), path.name());
 }


--- a/src/libstore/build/worker.cc
+++ b/src/libstore/build/worker.cc
@ -4,7 +4,7 @@
 #include "drv-output-substitution-goal.hh"
 #include "local-derivation-goal.hh"
 #include "signals.hh"
-#include "hook-instance.hh"
+#include "hook-instance.hh" // IWYU pragma: keep

 #include <poll.h>

@ -539,7 +539,7 @@ void Worker::waitForInput()
                } else {
                    printMsg(lvlVomit, "%1%: read %2% bytes",
                        goal->getName(), rd);
-                    std::string_view data((char *) buffer.data(), rd);
+                    std::string_view data(reinterpret_cast<char *>(buffer.data()), rd);
                    j->lastOutput = after;
                    handleWorkResult(goal, goal->handleChildOutput(k, data));
                }
@ -590,7 +590,7 @@ bool Worker::pathContentsGood(const StorePath & path)
        res = false;
    else {
        HashResult current = hashPath(info->narHash.type, store.printStorePath(path));
-        Hash nullHash(htSHA256);
+        Hash nullHash(HashType::SHA256);
        res = info->narHash == nullHash || info->narHash == current.first;
    }
    pathContentsGoodCache.insert_or_assign(path, res);
--- a/src/libstore/builtins/fetchurl.cc
+++ b/src/libstore/builtins/fetchurl.cc
@ -60,7 +60,7 @@ void builtinFetchurl(const BasicDerivation & drv, const std::string & netrcData)
                if (!hashedMirror.ends_with("/")) hashedMirror += '/';
                std::optional<HashType> ht = parseHashTypeOpt(getAttr("outputHashAlgo"));
                Hash h = newHashAllowEmpty(getAttr("outputHash"), ht);
-                fetch(hashedMirror + printHashType(h.type) + "/" + h.to_string(Base16, false));
+                fetch(hashedMirror + printHashType(h.type) + "/" + h.to_string(Base::Base16, false));
                return;
            } catch (Error & e) {
                debug(e.what());
--- a/src/libstore/content-address.cc
+++ b/src/libstore/content-address.cc
@ -61,7 +61,7 @@ std::string ContentAddress::render() const
                + makeFileIngestionPrefix(method);
        },
    }, method.raw)
-        + this->hash.to_string(Base32, true);
+        + this->hash.to_string(Base::Base32, true);
 }

 /**
--- a/src/libstore/crypto.cc
+++ b/src/libstore/crypto.cc
@ -44,16 +44,16 @@ std::string SecretKey::signDetached(std::string_view data) const
 {
    unsigned char sig[crypto_sign_BYTES];
    unsigned long long sigLen;
-    crypto_sign_detached(sig, &sigLen, (unsigned char *) data.data(), data.size(),
-        (unsigned char *) key.data());
-    return name + ":" + base64Encode(std::string((char *) sig, sigLen));
+    crypto_sign_detached(sig, &sigLen, reinterpret_cast<const unsigned char *>(data.data()), data.size(),
+        reinterpret_cast<const unsigned char *>(key.data()));
+    return name + ":" + base64Encode(std::string(reinterpret_cast<char *>(sig), sigLen));
 }

 PublicKey SecretKey::toPublicKey() const
 {
    unsigned char pk[crypto_sign_PUBLICKEYBYTES];
-    crypto_sign_ed25519_sk_to_pk(pk, (unsigned char *) key.data());
-    return PublicKey(name, std::string((char *) pk, crypto_sign_PUBLICKEYBYTES));
+    crypto_sign_ed25519_sk_to_pk(pk, reinterpret_cast<const unsigned char *>(key.data()));
+    return PublicKey(name, std::string(reinterpret_cast<char *>(pk), crypto_sign_PUBLICKEYBYTES));
 }

 SecretKey SecretKey::generate(std::string_view name)
@ -63,7 +63,7 @@ SecretKey SecretKey::generate(std::string_view name)
    if (crypto_sign_keypair(pk, sk) != 0)
        throw Error("key generation failed");

-    return SecretKey(name, std::string((char *) sk, crypto_sign_SECRETKEYBYTES));
+    return SecretKey(name, std::string(reinterpret_cast<char *>(sk), crypto_sign_SECRETKEYBYTES));
 }

 PublicKey::PublicKey(std::string_view s)
@ -85,9 +85,9 @@ bool verifyDetached(const std::string & data, const std::string & sig,
    if (sig2.size() != crypto_sign_BYTES)
        throw Error("signature is not valid");

-    return crypto_sign_verify_detached((unsigned char *) sig2.data(),
-        (unsigned char *) data.data(), data.size(),
-        (unsigned char *) key->second.key.data()) == 0;
+    return crypto_sign_verify_detached(reinterpret_cast<unsigned char *>(sig2.data()),
+        reinterpret_cast<const unsigned char *>(data.data()), data.size(),
+        reinterpret_cast<const unsigned char *>(key->second.key.data())) == 0;
 }

 PublicKeys getDefaultPublicKeys()
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@ -416,7 +416,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
                // TODO this is essentially RemoteStore::addCAToStore. Move it up to Store.
                return std::visit(overloaded {
                    [&](const TextIngestionMethod &) {
-                        if (hashType != htSHA256)
+                        if (hashType != HashType::SHA256)
                            throw UnimplementedError("When adding text-hashed data called '%s', only SHA-256 is supported but '%s' was given",
                                name, printHashType(hashType));
                        // We could stream this by changing Store
@ -453,7 +453,11 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
                hashAlgo = parseHashType(hashAlgoRaw);
            }

-            GeneratorSource dumpSource{[&]() -> WireFormatGenerator {
+            // Note to future maintainers: do *not* inline this into the
+            // generator statement as the lambda itself needs to live to the
+            // end of the generator's lifetime and is otherwise a UAF.
+            // NOLINTNEXTLINE(cppcoreguidelines-avoid-capturing-lambda-coroutines): does not outlive the outer function
+            auto g = [&]() -> WireFormatGenerator {
                if (method == FileIngestionMethod::Recursive) {
                    /* We parse the NAR dump through into `saved` unmodified,
                       so why all this extra work? We still parse the NAR so
@ -489,7 +493,8 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
                    }
                    co_yield std::move(file->contents);
                }
-            }()};
+            };
+            GeneratorSource dumpSource{g()};
            logger->startWork();
            auto path = store->addToStoreFromDump(dumpSource, baseName, method, hashAlgo);
            logger->stopWork();
@ -875,7 +880,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
        bool repair, dontCheckSigs;
        auto path = store->parseStorePath(readString(from));
        auto deriver = readString(from);
-        auto narHash = Hash::parseAny(readString(from), htSHA256);
+        auto narHash = Hash::parseAny(readString(from), HashType::SHA256);
        ValidPathInfo info { path, narHash };
        if (deriver != "")
            info.deriver = store->parseStorePath(deriver);
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@ -592,7 +592,7 @@ std::string Derivation::unparse(const Store & store, bool maskOutputs,
            [&](const DerivationOutput::CAFixed & dof) {
                s += ','; printUnquotedString(s, maskOutputs ? "" : store.printStorePath(dof.path(store, name, i.first)));
                s += ','; printUnquotedString(s, dof.ca.printMethodAlgo());
-                s += ','; printUnquotedString(s, dof.ca.hash.to_string(Base16, false));
+                s += ','; printUnquotedString(s, dof.ca.hash.to_string(Base::Base16, false));
            },
            [&](const DerivationOutput::CAFloating & dof) {
                s += ','; printUnquotedString(s, "");
@ -823,9 +823,9 @@ DrvHash hashDerivationModulo(Store & store, const Derivation & drv, bool maskOut
        std::map<std::string, Hash> outputHashes;
        for (const auto & i : drv.outputs) {
            auto & dof = std::get<DerivationOutput::CAFixed>(i.second.raw);
-            auto hash = hashString(htSHA256, "fixed:out:"
+            auto hash = hashString(HashType::SHA256, "fixed:out:"
                + dof.ca.printMethodAlgo() + ":"
-                + dof.ca.hash.to_string(Base16, false) + ":"
+                + dof.ca.hash.to_string(Base::Base16, false) + ":"
                + store.printStorePath(dof.path(store, drv.name, i.first)));
            outputHashes.insert_or_assign(i.first, std::move(hash));
        }
@ -870,11 +870,11 @@ DrvHash hashDerivationModulo(Store & store, const Derivation & drv, bool maskOut
            const auto h = get(res.hashes, outputName);
            if (!h)
                throw Error("no hash for output '%s' of derivation '%s'", outputName, drv.name);
-            inputs2[h->to_string(Base16, false)].value.insert(outputName);
+            inputs2[h->to_string(Base::Base16, false)].value.insert(outputName);
        }
    }

-    auto hash = hashString(htSHA256, drv.unparse(store, maskOutputs, &inputs2));
+    auto hash = hashString(HashType::SHA256, drv.unparse(store, maskOutputs, &inputs2));

    std::map<std::string, Hash> outputHashes;
    for (const auto & [outputName, _] : drv.outputs) {
@ -975,7 +975,7 @@ void writeDerivation(Sink & out, const Store & store, const BasicDerivation & dr
            [&](const DerivationOutput::CAFixed & dof) {
                out << store.printStorePath(dof.path(store, drv.name, i.first))
                    << dof.ca.printMethodAlgo()
-                    << dof.ca.hash.to_string(Base16, false);
+                    << dof.ca.hash.to_string(Base::Base16, false);
            },
            [&](const DerivationOutput::CAFloating & dof) {
                out << ""
@ -1007,7 +1007,7 @@ void writeDerivation(Sink & out, const Store & store, const BasicDerivation & dr
 std::string hashPlaceholder(const OutputNameView outputName)
 {
    // FIXME: memoize?
-    return "/" + hashString(htSHA256, concatStrings("nix-output:", outputName)).to_string(Base32, false);
+    return "/" + hashString(HashType::SHA256, concatStrings("nix-output:", outputName)).to_string(Base::Base32, false);
 }


@ -1199,7 +1199,7 @@ void Derivation::checkInvariants(Store & store, const StorePath & drvPath) const
 }


-const Hash impureOutputHash = hashString(htSHA256, "impure");
+const Hash impureOutputHash = hashString(HashType::SHA256, "impure");

 nlohmann::json DerivationOutput::toJSON(
    const Store & store, std::string_view drvName, OutputNameView outputName) const
@ -1212,7 +1212,7 @@ nlohmann::json DerivationOutput::toJSON(
        [&](const DerivationOutput::CAFixed & dof) {
            res["path"] = store.printStorePath(dof.path(store, drvName, outputName));
            res["hashAlgo"] = dof.ca.printMethodAlgo();
-            res["hash"] = dof.ca.hash.to_string(Base16, false);
+            res["hash"] = dof.ca.hash.to_string(Base::Base16, false);
            // FIXME print refs?
        },
        [&](const DerivationOutput::CAFloating & dof) {
--- a/src/libstore/downstream-placeholder.cc
+++ b/src/libstore/downstream-placeholder.cc
@ -5,7 +5,7 @@ namespace nix {

 std::string DownstreamPlaceholder::render() const
 {
-    return "/" + hash.to_string(Base32, false);
+    return "/" + hash.to_string(Base::Base32, false);
 }


@ -19,7 +19,7 @@ DownstreamPlaceholder DownstreamPlaceholder::unknownCaOutput(
    auto drvName = drvNameWithExtension.substr(0, drvNameWithExtension.size() - 4);
    auto clearText = "nix-upstream-output:" + std::string { drvPath.hashPart() } + ":" + outputPathName(drvName, outputName);
    return DownstreamPlaceholder {
-        hashString(htSHA256, clearText)
+        hashString(HashType::SHA256, clearText)
    };
 }

@ -31,10 +31,10 @@ DownstreamPlaceholder DownstreamPlaceholder::unknownDerivation(
    xpSettings.require(Xp::DynamicDerivations);
    auto compressed = compressHash(placeholder.hash, 20);
    auto clearText = "nix-computed-output:"
-        + compressed.to_string(Base32, false)
+        + compressed.to_string(Base::Base32, false)
        + ":" + std::string { outputName };
    return DownstreamPlaceholder {
-        hashString(htSHA256, clearText)
+        hashString(HashType::SHA256, clearText)
    };
 }

--- a/src/libstore/export-import.cc
+++ b/src/libstore/export-import.cc
@ -30,7 +30,7 @@ void Store::exportPath(const StorePath & path, Sink & sink)
 {
    auto info = queryPathInfo(path);

-    HashSink hashSink(htSHA256);
+    HashSink hashSink(HashType::SHA256);
    TeeSink teeSink(sink, hashSink);

    teeSink << narFromPath(path);
@ -41,7 +41,7 @@ void Store::exportPath(const StorePath & path, Sink & sink)
    Hash hash = hashSink.currentHash().first;
    if (hash != info->narHash && info->narHash != Hash(info->narHash.type))
        throw Error("hash of path '%s' has changed from '%s' to '%s'!",
-            printStorePath(path), info->narHash.to_string(Base32, true), hash.to_string(Base32, true));
+            printStorePath(path), info->narHash.to_string(Base::Base32, true), hash.to_string(Base::Base32, true));

    teeSink
        << exportMagic
@ -77,7 +77,7 @@ StorePaths Store::importPaths(Source & source, CheckSigsFlag checkSigs)
        auto references = CommonProto::Serialise<StorePathSet>::read(*this,
            CommonProto::ReadConn { .from = source });
        auto deriver = readString(source);
-        auto narHash = hashString(htSHA256, saved.s);
+        auto narHash = hashString(HashType::SHA256, saved.s);

        ValidPathInfo info { path, narHash };
        if (deriver != "")
--- a/src/libstore/filetransfer.cc
+++ b/src/libstore/filetransfer.cc
@ -5,7 +5,6 @@
 #include "s3.hh"
 #include "signals.hh"
 #include "compression.hh"
-#include "finally.hh"

 #if ENABLE_S3
 #include <aws/core/client/ClientConfiguration.h>
@ -143,9 +142,9 @@ struct curlFileTransfer : public FileTransfer

                if (successfulStatuses.count(getHTTPStatus()) && this->dataCallback) {
                    writtenToSink += realSize;
-                    dataCallback(*this, {(const char *) contents, realSize});
+                    dataCallback(*this, {static_cast<const char *>(contents), realSize});
                } else {
-                    this->result.data.append((const char *) contents, realSize);
+                    this->result.data.append(static_cast<const char *>(contents), realSize);
                }

                return realSize;
@ -157,13 +156,13 @@ struct curlFileTransfer : public FileTransfer

        static size_t writeCallbackWrapper(void * contents, size_t size, size_t nmemb, void * userp)
        {
-            return ((TransferItem *) userp)->writeCallback(contents, size, nmemb);
+            return static_cast<TransferItem *>(userp)->writeCallback(contents, size, nmemb);
        }

        size_t headerCallback(void * contents, size_t size, size_t nmemb)
        {
            size_t realSize = size * nmemb;
-            std::string line((char *) contents, realSize);
+            std::string line(static_cast<char *>(contents), realSize);
            printMsg(lvlVomit, "got header for '%s': %s", request.uri, trim(line));

            static std::regex statusLine("HTTP/[^ ]+ +[0-9]+(.*)", std::regex::extended | std::regex::icase);
@ -204,7 +203,7 @@ struct curlFileTransfer : public FileTransfer

        static size_t headerCallbackWrapper(void * contents, size_t size, size_t nmemb, void * userp)
        {
-            return ((TransferItem *) userp)->headerCallback(contents, size, nmemb);
+            return static_cast<TransferItem *>(userp)->headerCallback(contents, size, nmemb);
        }

        int progressCallback(double dltotal, double dlnow)
@ -219,7 +218,7 @@ struct curlFileTransfer : public FileTransfer

        static int progressCallbackWrapper(void * userp, double dltotal, double dlnow, double ultotal, double ulnow)
        {
-            return ((TransferItem *) userp)->progressCallback(dltotal, dlnow);
+            return static_cast<TransferItem *>(userp)->progressCallback(dltotal, dlnow);
        }

        static int debugCallback(CURL * handle, curl_infotype type, char * data, size_t size, void * userptr)
@ -246,7 +245,7 @@ struct curlFileTransfer : public FileTransfer

        static size_t readCallbackWrapper(char *buffer, size_t size, size_t nitems, void * userp)
        {
-            return ((TransferItem *) userp)->readCallback(buffer, size, nitems);
+            return static_cast<TransferItem *>(userp)->readCallback(buffer, size, nitems);
        }

        void init()
--- a/src/libstore/gc.cc
+++ b/src/libstore/gc.cc
@ -42,7 +42,7 @@ static void makeSymlink(const Path & link, const Path & target)

 void LocalStore::addIndirectRoot(const Path & path)
 {
-    std::string hash = hashString(htSHA1, path).to_string(Base32, false);
+    std::string hash = hashString(HashType::SHA1, path).to_string(Base::Base32, false);
    Path realRoot = canonPath(fmt("%1%/%2%/auto/%3%", stateDir, gcRootsDir, hash));
    makeSymlink(realRoot, path);
 }
--- a/src/libstore/legacy-ssh-store.cc
+++ b/src/libstore/legacy-ssh-store.cc
@ -183,7 +183,7 @@ struct LegacySSHStore : public virtual LegacySSHStoreConfig, public virtual Stor
                << ServeProto::Command::AddToStoreNar
                << printStorePath(info.path)
                << (info.deriver ? printStorePath(*info.deriver) : "")
-                << info.narHash.to_string(Base16, false);
+                << info.narHash.to_string(Base::Base16, false);
            conn->to << ServeProto::write(*this, *conn, info.references);
            conn->to
                << info.registrationTime
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@ -11,7 +11,6 @@
 #include "finally.hh"
 #include "compression.hh"

-#include <iostream>
 #include <algorithm>
 #include <cstring>

@ -539,9 +538,10 @@ void LocalStore::openDB(State & state, bool create)
    {
        SQLiteStmt stmt;
        stmt.create(db, "pragma main.journal_mode;");
-        if (sqlite3_step(stmt) != SQLITE_ROW)
+        auto use = stmt.use();
+        if (use.step() != SQLITE_ROW)
            SQLiteError::throw_(db, "querying journal mode");
-        prevMode = std::string((const char *) sqlite3_column_text(stmt, 0));
+        prevMode = use.getStr(0);
    }
    if (prevMode != mode &&
        sqlite3_exec(db, ("pragma main.journal_mode = " + mode + ";").c_str(), 0, 0, 0) != SQLITE_OK)
@ -842,7 +842,7 @@ uint64_t LocalStore::addValidPath(State & state,

    state.stmts->RegisterValidPath.use()
        (printStorePath(info.path))
-        (info.narHash.to_string(Base16, true))
+        (info.narHash.to_string(Base::Base16, true))
        (info.registrationTime == 0 ? time(0) : info.registrationTime)
        (info.deriver ? printStorePath(*info.deriver) : "", (bool) info.deriver)
        (info.narSize, info.narSize != 0)
@ -916,19 +916,22 @@ std::shared_ptr<const ValidPathInfo> LocalStore::queryPathInfoInternal(State & s

    info->registrationTime = useQueryPathInfo.getInt(2);

-    auto s = (const char *) sqlite3_column_text(state.stmts->QueryPathInfo, 3);
-    if (s) info->deriver = parseStorePath(s);
+    if (auto deriver = useQueryPathInfo.getStrNullable(3); deriver.has_value()) {
+        info->deriver = parseStorePath(*deriver);
+    }

    /* Note that narSize = NULL yields 0. */
    info->narSize = useQueryPathInfo.getInt(4);

    info->ultimate = useQueryPathInfo.getInt(5) == 1;

-    s = (const char *) sqlite3_column_text(state.stmts->QueryPathInfo, 6);
-    if (s) info->sigs = tokenizeString<StringSet>(s, " ");
+    if (auto sigs = useQueryPathInfo.getStrNullable(6); sigs.has_value()) {
+        info->sigs = tokenizeString<StringSet>(*sigs, " ");
+    }

-    s = (const char *) sqlite3_column_text(state.stmts->QueryPathInfo, 7);
-    if (s) info->ca = ContentAddress::parseOpt(s);
+    if (auto ca = useQueryPathInfo.getStrNullable(7); ca.has_value()) {
+        info->ca = ContentAddress::parseOpt(*ca);
+    }

    /* Get the references. */
    auto useQueryReferences(state.stmts->QueryReferences.use()(info->id));
@ -945,7 +948,7 @@ void LocalStore::updatePathInfo(State & state, const ValidPathInfo & info)
 {
    state.stmts->UpdatePathInfo.use()
        (info.narSize, info.narSize != 0)
-        (info.narHash.to_string(Base16, true))
+        (info.narHash.to_string(Base::Base16, true))
        (info.ultimate ? 1 : 0, info.ultimate)
        (concatStringsSep(" ", info.sigs), !info.sigs.empty())
        (renderContentAddress(info.ca), (bool) info.ca)
@ -1063,9 +1066,9 @@ std::optional<StorePath> LocalStore::queryPathFromHashPart(const std::string & h

        if (!useQueryPathFromHashPart.next()) return {};

-        const char * s = (const char *) sqlite3_column_text(state->stmts->QueryPathFromHashPart, 0);
-        if (s && prefix.compare(0, prefix.size(), s, prefix.size()) == 0)
-            return parseStorePath(s);
+        auto s = useQueryPathFromHashPart.getStrNullable(0);
+        if (s.has_value() && s->starts_with(prefix))
+            return parseStorePath(*s);
        return {};
    });
 }
@ -1123,7 +1126,7 @@ void LocalStore::registerValidPaths(const ValidPathInfos & infos)
        StorePathSet paths;

        for (auto & [_, i] : infos) {
-            assert(i.narHash.type == htSHA256);
+            assert(i.narHash.type == HashType::SHA256);
            if (isValidPath_(*state, i.path))
                updatePathInfo(*state, i);
            else
@ -1241,7 +1244,7 @@ void LocalStore::addToStore(const ValidPathInfo & info, Source & source,

            /* While restoring the path from the NAR, compute the hash
               of the NAR. */
-            HashSink hashSink(htSHA256);
+            HashSink hashSink(HashType::SHA256);

            TeeSource wrapperSource { source, hashSink };

@ -1252,7 +1255,7 @@ void LocalStore::addToStore(const ValidPathInfo & info, Source & source,

            if (hashResult.first != info.narHash)
                throw Error("hash mismatch importing path '%s';\n  specified: %s\n  got:       %s",
-                    printStorePath(info.path), info.narHash.to_string(Base32, true), hashResult.first.to_string(Base32, true));
+                    printStorePath(info.path), info.narHash.to_string(Base::Base32, true), hashResult.first.to_string(Base::Base32, true));

            if (hashResult.second != info.narSize)
                throw Error("size mismatch importing path '%s';\n  specified: %s\n  got:       %s",
@ -1268,8 +1271,8 @@ void LocalStore::addToStore(const ValidPathInfo & info, Source & source,
                if (specified.hash != actualHash.hash) {
                    throw Error("ca hash mismatch importing path '%s';\n  specified: %s\n  got:       %s",
                        printStorePath(info.path),
-                        specified.hash.to_string(Base32, true),
-                        actualHash.hash.to_string(Base32, true));
+                        specified.hash.to_string(Base::Base32, true),
+                        actualHash.hash.to_string(Base::Base32, true));
                }
            }

@ -1318,7 +1321,7 @@ StorePath LocalStore::addToStoreFromDump(Source & source0, std::string_view name

        auto *toRealloc = dumpBuffer.release();
        if (auto realloced = realloc(toRealloc, oldSize + want)) {
-            dumpBuffer.reset((char*) realloced);
+            dumpBuffer.reset(static_cast<char *>(realloced));
        } else {
            free(toRealloc);
            throw std::bad_alloc();
@ -1404,8 +1407,8 @@ StorePath LocalStore::addToStoreFromDump(Source & source0, std::string_view name
            /* For computing the nar hash. In recursive SHA-256 mode, this
               is the same as the store hash, so no need to do it again. */
            auto narHash = std::pair { hash, size };
-            if (method != FileIngestionMethod::Recursive || hashAlgo != htSHA256) {
-                HashSink narSink { htSHA256 };
+            if (method != FileIngestionMethod::Recursive || hashAlgo != HashType::SHA256) {
+                HashSink narSink { HashType::SHA256 };
                narSink << dumpPath(realPath);
                narHash = narSink.finish();
            }
@ -1436,7 +1439,7 @@ StorePath LocalStore::addTextToStore(
    std::string_view s,
    const StorePathSet & references, RepairFlag repair)
 {
-    auto hash = hashString(htSHA256, s);
+    auto hash = hashString(HashType::SHA256, s);
    auto dstPath = makeTextPath(name, TextInfo {
        .hash = hash,
        .references = references,
@ -1462,7 +1465,7 @@ StorePath LocalStore::addTextToStore(

            StringSink sink;
            sink << dumpString(s);
-            auto narHash = hashString(htSHA256, sink.s);
+            auto narHash = hashString(HashType::SHA256, sink.s);

            optimisePath(realPath, repair);

@ -1573,7 +1576,7 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
        for (auto & link : readDirectory(linksDir)) {
            printMsg(lvlTalkative, "checking contents of '%s'", link.name);
            Path linkPath = linksDir + "/" + link.name;
-            std::string hash = hashPath(htSHA256, linkPath).first.to_string(Base32, false);
+            std::string hash = hashPath(HashType::SHA256, linkPath).first.to_string(Base::Base32, false);
            if (hash != link.name) {
                printError("link '%s' was modified! expected hash '%s', got '%s'",
                    linkPath, link.name, hash);
@ -1590,7 +1593,7 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)

        printInfo("checking store hashes...");

-        Hash nullHash(htSHA256);
+        Hash nullHash(HashType::SHA256);

        for (auto & i : validPaths) {
            try {
@ -1606,7 +1609,7 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)

                if (info->narHash != nullHash && info->narHash != current.first) {
                    printError("path '%s' was modified! expected hash '%s', got '%s'",
-                        printStorePath(i), info->narHash.to_string(Base32, true), current.first.to_string(Base32, true));
+                        printStorePath(i), info->narHash.to_string(Base::Base32, true), current.first.to_string(Base::Base32, true));
                    if (repair) repairPath(i); else errors = true;
                } else {

--- a/src/libstore/make-content-addressed.cc
+++ b/src/libstore/make-content-addressed.cc
@ -45,7 +45,7 @@ std::map<StorePath, StorePath> makeContentAddressed(

        auto narModuloHash = [&] {
            StringSource source{sink.s};
-            return computeHashModulo(htSHA256, oldHashPart, source).first;
+            return computeHashModulo(HashType::SHA256, oldHashPart, source).first;
        }();

        ValidPathInfo info {
@ -63,7 +63,7 @@ std::map<StorePath, StorePath> makeContentAddressed(

        const auto rewritten = rewriteStrings(sink.s, {{oldHashPart, std::string(info.path.hashPart())}});

-        info.narHash = hashString(htSHA256, rewritten);
+        info.narHash = hashString(HashType::SHA256, rewritten);
        info.narSize = sink.s.size();

        StringSource source(rewritten);
--- a/src/libstore/nar-info-disk-cache.cc
+++ b/src/libstore/nar-info-disk-cache.cc
@ -334,9 +334,9 @@ public:
                    (std::string(info->path.name()))
                    (narInfo ? narInfo->url : "", narInfo != 0)
                    (narInfo ? narInfo->compression : "", narInfo != 0)
-                    (narInfo && narInfo->fileHash ? narInfo->fileHash->to_string(Base32, true) : "", narInfo && narInfo->fileHash)
+                    (narInfo && narInfo->fileHash ? narInfo->fileHash->to_string(Base::Base32, true) : "", narInfo && narInfo->fileHash)
                    (narInfo ? narInfo->fileSize : 0, narInfo != 0 && narInfo->fileSize)
-                    (info->narHash.to_string(Base32, true))
+                    (info->narHash.to_string(Base::Base32, true))
                    (info->narSize)
                    (concatStringsSep(" ", info->shortRefs()))
                    (info->deriver ? std::string(info->deriver->to_string()) : "", (bool) info->deriver)
--- a/src/libstore/nar-info.cc
+++ b/src/libstore/nar-info.cc
@ -104,11 +104,11 @@ std::string NarInfo::to_string(const Store & store) const
    res += "URL: " + url + "\n";
    assert(compression != "");
    res += "Compression: " + compression + "\n";
-    assert(fileHash && fileHash->type == htSHA256);
-    res += "FileHash: " + fileHash->to_string(Base32, true) + "\n";
+    assert(fileHash && fileHash->type == HashType::SHA256);
+    res += "FileHash: " + fileHash->to_string(Base::Base32, true) + "\n";
    res += "FileSize: " + std::to_string(fileSize) + "\n";
-    assert(narHash.type == htSHA256);
-    res += "NarHash: " + narHash.to_string(Base32, true) + "\n";
+    assert(narHash.type == HashType::SHA256);
+    res += "NarHash: " + narHash.to_string(Base::Base32, true) + "\n";
    res += "NarSize: " + std::to_string(narSize) + "\n";

    res += "References: " + concatStringsSep(" ", shortRefs()) + "\n";
--- a/src/libstore/optimise-store.cc
+++ b/src/libstore/optimise-store.cc
@ -2,14 +2,11 @@
 #include "globals.hh"
 #include "signals.hh"

-#include <cstdlib>
 #include <cstring>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <unistd.h>
 #include <errno.h>
-#include <stdio.h>
-#include <regex>


 namespace nix {
@ -145,17 +142,17 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
       Also note that if `path' is a symlink, then we're hashing the
       contents of the symlink (i.e. the result of readlink()), not
       the contents of the target (which may not even exist). */
-    Hash hash = hashPath(htSHA256, path).first;
-    debug("'%1%' has hash '%2%'", path, hash.to_string(Base32, true));
+    Hash hash = hashPath(HashType::SHA256, path).first;
+    debug("'%1%' has hash '%2%'", path, hash.to_string(Base::Base32, true));

    /* Check if this is a known hash. */
-    Path linkPath = linksDir + "/" + hash.to_string(Base32, false);
+    Path linkPath = linksDir + "/" + hash.to_string(Base::Base32, false);

    /* Maybe delete the link, if it has been corrupted. */
    if (pathExists(linkPath)) {
        auto stLink = lstat(linkPath);
        if (st.st_size != stLink.st_size
-            || (repair && hash != hashPath(htSHA256, linkPath).first))
+            || (repair && hash != hashPath(HashType::SHA256, linkPath).first))
        {
            // XXX: Consider overwriting linkPath with our valid version.
            warn("removing corrupted link '%s'", linkPath);
--- a/src/libstore/path-info.cc
+++ b/src/libstore/path-info.cc
@ -29,7 +29,7 @@ std::string ValidPathInfo::fingerprint(const Store & store) const
            store.printStorePath(path));
    return
        "1;" + store.printStorePath(path) + ";"
-        + narHash.to_string(Base32, true) + ";"
+        + narHash.to_string(Base::Base32, true) + ";"
        + std::to_string(narSize) + ";"
        + concatStringsSep(",", store.printStorePathSet(references));
 }
--- a/src/libstore/path-references.cc
+++ b/src/libstore/path-references.cc
@ -46,7 +46,7 @@ std::pair<StorePathSet, HashResult> scanForReferences(
    const std::string & path,
    const StorePathSet & refs)
 {
-    HashSink hashSink { htSHA256 };
+    HashSink hashSink { HashType::SHA256 };
    auto found = scanForReferences(hashSink, path, refs);
    auto hash = hashSink.finish();
    return std::pair<StorePathSet, HashResult>(found, hash);
--- a/src/libstore/path.cc
+++ b/src/libstore/path.cc
@ -46,7 +46,7 @@ StorePath::StorePath(std::string_view _baseName)
 }

 StorePath::StorePath(const Hash & hash, std::string_view _name)
-    : baseName((hash.to_string(Base32, false) + "-").append(std::string(_name)))
+    : baseName((hash.to_string(Base::Base32, false) + "-").append(std::string(_name)))
 {
    checkName(baseName, name());
 }
@ -60,7 +60,7 @@ StorePath StorePath::dummy("ffffffffffffffffffffffffffffffff-x");

 StorePath StorePath::random(std::string_view name)
 {
-    Hash hash(htSHA1);
+    Hash hash(HashType::SHA1);
    randombytes_buf(hash.hash, hash.hashSize);
    return StorePath(hash, name);
 }
--- a/src/libstore/realisation.hh
+++ b/src/libstore/realisation.hh
@ -39,7 +39,7 @@ struct DrvOutput {
    std::string to_string() const;

    std::string strHash() const
-    { return drvHash.to_string(Base16, true); }
+    { return drvHash.to_string(Base::Base16, true); }

    static DrvOutput parse(const std::string &);

--- a/src/libstore/remote-store.cc
+++ b/src/libstore/remote-store.cc
@ -397,7 +397,7 @@ ref<const ValidPathInfo> RemoteStore::addCAToStore(

        std::visit(overloaded {
            [&](const TextIngestionMethod & thm) -> void {
-                if (hashType != htSHA256)
+                if (hashType != HashType::SHA256)
                    throw UnimplementedError("When adding text-hashed data called '%s', only SHA-256 is supported but '%s' was given",
                        name, printHashType(hashType));
                std::string s = dump.drain();
@ -409,7 +409,7 @@ ref<const ValidPathInfo> RemoteStore::addCAToStore(
                conn->to
                    << WorkerProto::Op::AddToStore
                    << name
-                    << ((hashType == htSHA256 && fim == FileIngestionMethod::Recursive) ? 0 : 1) /* backwards compatibility hack */
+                    << ((hashType == HashType::SHA256 && fim == FileIngestionMethod::Recursive) ? 0 : 1) /* backwards compatibility hack */
                    << (fim == FileIngestionMethod::Recursive ? 1 : 0)
                    << printHashType(hashType);

@ -461,7 +461,7 @@ void RemoteStore::addToStore(const ValidPathInfo & info, Source & source,
    conn->to << WorkerProto::Op::AddToStoreNar
             << printStorePath(info.path)
             << (info.deriver ? printStorePath(*info.deriver) : "")
-             << info.narHash.to_string(Base16, false);
+             << info.narHash.to_string(Base::Base16, false);
    conn->to << WorkerProto::write(*this, *conn, info.references);
    conn->to << info.registrationTime << info.narSize
             << info.ultimate << info.sigs << renderContentAddress(info.ca)
@ -533,7 +533,7 @@ StorePath RemoteStore::addTextToStore(
    RepairFlag repair)
 {
    StringSource source(s);
-    return addCAToStore(source, name, TextIngestionMethod {}, htSHA256, references, repair)->path;
+    return addCAToStore(source, name, TextIngestionMethod {}, HashType::SHA256, references, repair)->path;
 }

 void RemoteStore::registerDrvOutput(const Realisation & info)
--- a/src/libstore/remote-store.hh
+++ b/src/libstore/remote-store.hh
@ -84,7 +84,7 @@ public:
     * Add a content-addressable store path. Does not support references. `dump` will be drained.
     */
    StorePath addToStoreFromDump(Source & dump, std::string_view name,
-        FileIngestionMethod method = FileIngestionMethod::Recursive, HashType hashAlgo = htSHA256, RepairFlag repair = NoRepair, const StorePathSet & references = StorePathSet()) override;
+        FileIngestionMethod method = FileIngestionMethod::Recursive, HashType hashAlgo = HashType::SHA256, RepairFlag repair = NoRepair, const StorePathSet & references = StorePathSet()) override;

    void addToStore(const ValidPathInfo & info, Source & nar,
        RepairFlag repair, CheckSigsFlag checkSigs) override;
--- a/src/libstore/serve-protocol.cc
+++ b/src/libstore/serve-protocol.cc
@ -88,7 +88,7 @@ WireFormatGenerator ServeProto::Serialise<UnkeyedValidPathInfo>::write(const Sto
    co_yield info.narSize; // downloadSize, lie a little
    co_yield info.narSize;
    if (GET_PROTOCOL_MINOR(conn.version) >= 4) {
-        co_yield info.narHash.to_string(Base32, true);
+        co_yield info.narHash.to_string(Base::Base32, true);
        co_yield renderContentAddress(info.ca);
        co_yield info.sigs;
    }
--- a/src/libstore/sqlite.cc
+++ b/src/libstore/sqlite.cc
@ -199,11 +199,20 @@ bool SQLiteStmt::Use::next()
    return r == SQLITE_ROW;
 }

+std::optional<std::string> SQLiteStmt::Use::getStrNullable(int col)
+{
+    auto s = reinterpret_cast<const char *>(sqlite3_column_text(stmt, col));
+    return s != nullptr ? std::make_optional<std::string>((s)) : std::nullopt;
+}
+
 std::string SQLiteStmt::Use::getStr(int col)
 {
-    auto s = (const char *) sqlite3_column_text(stmt, col);
-    assert(s);
-    return s;
+    if (auto res = getStrNullable(col); res.has_value()) {
+        return *res;
+    } else {
+        // FIXME: turn into fatal non-exception error with actual formatting when we have those
+        assert(false && "sqlite3 retrieved unexpected null");
+    }
 }

 int64_t SQLiteStmt::Use::getInt(int col)
--- a/src/libstore/sqlite.hh
+++ b/src/libstore/sqlite.hh
@ -107,6 +107,7 @@ struct SQLiteStmt
        bool next();

        std::string getStr(int col);
+        std::optional<std::string> getStrNullable(int col);
        int64_t getInt(int col);
        bool isNull(int col);
    };
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@ -156,7 +156,7 @@ StorePath Store::makeStorePath(std::string_view type,
    /* e.g., "source:sha256:1abc...:/nix/store:foo.tar.gz" */
    auto s = std::string(type) + ":" + std::string(hash)
        + ":" + storeDir + ":" + std::string(name);
-    auto h = compressHash(hashString(htSHA256, s), 20);
+    auto h = compressHash(hashString(HashType::SHA256, s), 20);
    return StorePath(h, name);
 }

@ -164,7 +164,7 @@ StorePath Store::makeStorePath(std::string_view type,
 StorePath Store::makeStorePath(std::string_view type,
    const Hash & hash, std::string_view name) const
 {
-    return makeStorePath(type, hash.to_string(Base16, true), name);
+    return makeStorePath(type, hash.to_string(Base::Base16, true), name);
 }


@ -194,7 +194,7 @@ static std::string makeType(

 StorePath Store::makeFixedOutputPath(std::string_view name, const FixedOutputInfo & info) const
 {
-    if (info.hash.type == htSHA256 && info.method == FileIngestionMethod::Recursive) {
+    if (info.hash.type == HashType::SHA256 && info.method == FileIngestionMethod::Recursive) {
        return makeStorePath(makeType(*this, "source", info.references), info.hash, name);
    } else {
        if (!info.references.empty()) {
@ -202,10 +202,10 @@ StorePath Store::makeFixedOutputPath(std::string_view name, const FixedOutputInf
                name);
        }
        return makeStorePath("output:out",
-            hashString(htSHA256,
+            hashString(HashType::SHA256,
                "fixed:out:"
                + makeFileIngestionPrefix(info.method)
-                + info.hash.to_string(Base16, true) + ":"),
+                + info.hash.to_string(Base::Base16, true) + ":"),
            name);
    }
 }
@ -213,7 +213,7 @@ StorePath Store::makeFixedOutputPath(std::string_view name, const FixedOutputInf

 StorePath Store::makeTextPath(std::string_view name, const TextInfo & info) const
 {
-    assert(info.hash.type == htSHA256);
+    assert(info.hash.type == HashType::SHA256);
    return makeStorePath(
        makeType(*this, "text", StoreReferences {
            .others = info.references,
@ -259,7 +259,7 @@ StorePath Store::computeStorePathForText(
    const StorePathSet & references) const
 {
    return makeTextPath(name, TextInfo {
-        .hash = hashString(htSHA256, s),
+        .hash = hashString(HashType::SHA256, s),
        .references = references,
    });
 }
@ -407,7 +407,7 @@ ValidPathInfo Store::addToStoreSlow(std::string_view name, const Path & srcPath,
    FileIngestionMethod method, HashType hashAlgo,
    std::optional<Hash> expectedCAHash)
 {
-    HashSink narHashSink { htSHA256 };
+    HashSink narHashSink { HashType::SHA256 };
    HashSink caHashSink { hashAlgo };

    /* Note that fileSink and unusualHashTee must be mutually exclusive, since
@ -416,7 +416,7 @@ ValidPathInfo Store::addToStoreSlow(std::string_view name, const Path & srcPath,
    RetrieveRegularNARSink fileSink { caHashSink };
    TeeSink unusualHashTee { narHashSink, caHashSink };

-    auto & narSink = method == FileIngestionMethod::Recursive && hashAlgo != htSHA256
+    auto & narSink = method == FileIngestionMethod::Recursive && hashAlgo != HashType::SHA256
        ? static_cast<Sink &>(unusualHashTee)
        : narHashSink;

@ -442,7 +442,7 @@ ValidPathInfo Store::addToStoreSlow(std::string_view name, const Path & srcPath,
       finish. */
    auto [narHash, narSize] = narHashSink.finish();

-    auto hash = method == FileIngestionMethod::Recursive && hashAlgo == htSHA256
+    auto hash = method == FileIngestionMethod::Recursive && hashAlgo == HashType::SHA256
        ? narHash
        : caHashSink.finish().first;

@ -854,7 +854,7 @@ std::string Store::makeValidityRegistration(const StorePathSet & paths,
        auto info = queryPathInfo(i);

        if (showHash) {
-            s += info->narHash.to_string(Base16, false) + "\n";
+            s += info->narHash.to_string(Base::Base16, false) + "\n";
            s += fmt("%1%\n", info->narSize);
        }

@ -1257,7 +1257,7 @@ std::optional<ValidPathInfo> decodeValidPathInfo(const Store & store, std::istre
    if (!hashGiven) {
        std::string s;
        getline(str, s);
-        auto narHash = Hash::parseAny(s, htSHA256);
+        auto narHash = Hash::parseAny(s, HashType::SHA256);
        getline(str, s);
        auto narSize = string2Int<uint64_t>(s);
        if (!narSize) throw Error("number expected");
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@ -311,7 +311,7 @@ public:
     */
    std::pair<StorePath, Hash> computeStorePathForPath(std::string_view name,
        const Path & srcPath, FileIngestionMethod method = FileIngestionMethod::Recursive,
-        HashType hashAlgo = htSHA256, PathFilter & filter = defaultPathFilter) const;
+        HashType hashAlgo = HashType::SHA256, PathFilter & filter = defaultPathFilter) const;

    /**
     * Preparatory part of addTextToStore().
@ -524,7 +524,7 @@ public:
        std::string_view name,
        const Path & srcPath,
        FileIngestionMethod method = FileIngestionMethod::Recursive,
-        HashType hashAlgo = htSHA256,
+        HashType hashAlgo = HashType::SHA256,
        PathFilter & filter = defaultPathFilter,
        RepairFlag repair = NoRepair,
        const StorePathSet & references = StorePathSet());
@ -535,7 +535,7 @@ public:
     * memory.
     */
    ValidPathInfo addToStoreSlow(std::string_view name, const Path & srcPath,
-        FileIngestionMethod method = FileIngestionMethod::Recursive, HashType hashAlgo = htSHA256,
+        FileIngestionMethod method = FileIngestionMethod::Recursive, HashType hashAlgo = HashType::SHA256,
        std::optional<Hash> expectedCAHash = {});

    /**
@ -548,7 +548,7 @@ public:
     * \todo remove?
     */
    virtual StorePath addToStoreFromDump(Source & dump, std::string_view name,
-        FileIngestionMethod method = FileIngestionMethod::Recursive, HashType hashAlgo = htSHA256, RepairFlag repair = NoRepair,
+        FileIngestionMethod method = FileIngestionMethod::Recursive, HashType hashAlgo = HashType::SHA256, RepairFlag repair = NoRepair,
        const StorePathSet & references = StorePathSet())
    { unsupported("addToStoreFromDump"); }

@ -679,7 +679,7 @@ public:
     */
    nlohmann::json pathInfoToJSON(const StorePathSet & storePaths,
        bool includeImpureInfo, bool showClosureSize,
-        Base hashBase = Base32,
+        Base hashBase = Base::Base32,
        AllowInvalidFlag allowInvalid = DisallowInvalid);

    /**
--- a/src/libstore/worker-protocol.cc
+++ b/src/libstore/worker-protocol.cc
@ -158,7 +158,7 @@ WireFormatGenerator WorkerProto::Serialise<ValidPathInfo>::write(const Store & s
 UnkeyedValidPathInfo WorkerProto::Serialise<UnkeyedValidPathInfo>::read(const Store & store, ReadConn conn)
 {
    auto deriver = readString(conn.from);
-    auto narHash = Hash::parseAny(readString(conn.from), htSHA256);
+    auto narHash = Hash::parseAny(readString(conn.from), HashType::SHA256);
    UnkeyedValidPathInfo info(narHash);
    if (deriver != "") info.deriver = store.parseStorePath(deriver);
    info.references = WorkerProto::Serialise<StorePathSet>::read(store, conn);
@ -174,7 +174,7 @@ UnkeyedValidPathInfo WorkerProto::Serialise<UnkeyedValidPathInfo>::read(const St
 WireFormatGenerator WorkerProto::Serialise<UnkeyedValidPathInfo>::write(const Store & store, WriteConn conn, const UnkeyedValidPathInfo & pathInfo)
 {
    co_yield (pathInfo.deriver ? store.printStorePath(*pathInfo.deriver) : "");
-    co_yield pathInfo.narHash.to_string(Base16, false);
+    co_yield pathInfo.narHash.to_string(Base::Base16, false);
    co_yield WorkerProto::write(store, conn, pathInfo.references);
    co_yield pathInfo.registrationTime;
    co_yield pathInfo.narSize;
--- a/src/libutil/args.hh
+++ b/src/libutil/args.hh
@ -15,7 +15,7 @@

 namespace nix {

-enum HashType : char;
+enum class HashType : char;

 class MultiCommand;

--- a/src/libutil/charptr-cast.hh
+++ b/src/libutil/charptr-cast.hh
@ -0,0 +1,140 @@
+#pragma once
+/** @file Safe casts between character pointer types. */
+
+#include <concepts> // IWYU pragma: keep
+#include <type_traits>
+
+namespace nix {
+
+namespace charptr_cast_detail {
+
+/** Custom version of std::decay that does not eat CV qualifiers on \c {char * const}. */
+template<typename T>
+struct DecayArrayInternal
+{
+    using type = T;
+};
+
+template <typename T>
+struct DecayArrayInternal<T[]>
+{
+    using type = T *;
+};
+
+template <typename T, std::size_t N>
+struct DecayArrayInternal<T[N]>
+{
+    using type = T *;
+};
+
+template <typename T>
+using DecayArray = DecayArrayInternal<T>::type;
+
+/** Is a character type for the purposes of safe reinterpret_cast. */
+template<typename T>
+concept IsChar = std::same_as<T, char> || std::same_as<T, unsigned char>;
+
+template<typename T>
+concept IsConvertibleToChar = std::same_as<T, char8_t> || std::same_as<T, void> || IsChar<T>;
+
+template<typename T>
+concept IsDecayOrPointer = std::is_pointer_v<T> || std::is_pointer_v<DecayArray<T>>;
+
+template<typename From, typename To>
+concept ValidQualifiers = requires {
+    // Does not discard const
+    requires !std::is_const_v<From> || std::is_const_v<To>;
+    // Don't deal with volatile
+    requires !std::is_volatile_v<From> && !std::is_volatile_v<To>;
+};
+
+template<typename From, typename To>
+concept BaseCase = requires {
+    // Cannot cast away const
+    requires ValidQualifiers<From, To>;
+    // At base case, neither should be pointers
+    requires !std::is_pointer_v<From> && !std::is_pointer_v<To>;
+    // Finally are the types compatible?
+    requires IsConvertibleToChar<std::remove_cv_t<From>>;
+    requires IsChar<std::remove_cv_t<To>>;
+};
+
+static_assert(BaseCase<char, char>);
+static_assert(BaseCase<unsigned char, char>);
+static_assert(BaseCase<char8_t, char>);
+static_assert(!BaseCase<const char8_t, char>);
+static_assert(!BaseCase<const char8_t, unsigned char>);
+static_assert(BaseCase<void, unsigned char>);
+// Not legal to cast to char8_t
+static_assert(!BaseCase<void, char8_t>);
+// No pointers
+static_assert(!BaseCase<void *, char8_t>);
+static_assert(!BaseCase<char *, char *>);
+
+// Required to be written in the old style because recursion in concepts is not
+// allowed. Personally I think the committee hates fun.
+template<typename From, typename To, typename = void>
+struct RecursionHelper : std::false_type
+{};
+
+template<typename From, typename To>
+struct RecursionHelper<From, To, std::enable_if_t<BaseCase<From, To>>> : std::true_type
+{};
+
+template<typename From, typename To>
+struct RecursionHelper<
+    From,
+    To,
+    std::enable_if_t<std::is_pointer_v<From> && std::is_pointer_v<To> && ValidQualifiers<From, To>>>
+    : RecursionHelper<std::remove_pointer_t<From>, std::remove_pointer_t<To>>
+{};
+
+template<typename From, typename To>
+concept IsCharCastable = requires {
+    // We only decay arrays in From for safety reasons. There is almost no reason
+    // to cast *into* an array and such code probably needs closer inspection
+    // anyway.
+    requires RecursionHelper<DecayArray<From>, To>::value;
+    requires IsDecayOrPointer<From> && std::is_pointer_v<To>;
+};
+
+static_assert(!IsCharCastable<char **, char *>);
+static_assert(IsCharCastable<char *, char *>);
+static_assert(!IsCharCastable<const char *, char *>);
+static_assert(!IsCharCastable<volatile char *, char *>);
+static_assert(!IsCharCastable<char *, volatile char *>);
+static_assert(IsCharCastable<char *, const char *>);
+static_assert(IsCharCastable<char **, const char **>);
+static_assert(IsCharCastable<char **, const char * const *>);
+static_assert(!IsCharCastable<char * const *, const char **>);
+static_assert(!IsCharCastable<char, char>);
+static_assert(IsCharCastable<const char *, const unsigned char *>);
+static_assert(!IsCharCastable<char [64][64], char **>);
+static_assert(IsCharCastable<char [64], char *>);
+}
+
+/** Casts between character pointers with guaranteed safety. If this compiles,
+ * it is at least a sound conversion per C++23 §7.2.1 line 11.
+ *
+ * This will not let you:
+ * - Turn things into void *
+ * - Turn things that are not char into char
+ * - Turn things into things that are not char
+ * - Cast away const
+ *
+ * At every level in the pointer indirections, \c To must as const or more
+ * const than \c From.
+ *
+ * \c From may be any character pointer or void pointer or an array of characters.
+ *
+ * N.B. Be careful, the template args are in the possibly-surprising
+ * order To, From due to deduction.
+ */
+template<typename To, typename From>
+    requires charptr_cast_detail::IsCharCastable<From, To>
+inline To charptr_cast(From p)
+{
+    return reinterpret_cast<To>(p);
+}
+
+}
--- a/src/libutil/compression.cc
+++ b/src/libutil/compression.cc
@ -119,8 +119,8 @@ private:

    static ssize_t callback_write(struct archive * archive, void * _self, const void * buffer, size_t length)
    {
-        auto self = (ArchiveCompressionSink *) _self;
-        self->nextSink({(const char *) buffer, length});
+        auto self = static_cast<ArchiveCompressionSink *>(_self);
+        self->nextSink({static_cast<const char *>(buffer), length});
        return length;
    }
 };
@ -160,7 +160,7 @@ struct BrotliDecompressionSource : Source

    size_t read(char * data, size_t len) override
    {
-        uint8_t * out = (uint8_t *) data;
+        uint8_t * out = reinterpret_cast<uint8_t *>(data);
        const auto * begin = out;

        while (len && !BrotliDecoderIsFinished(state.get())) {
@ -172,7 +172,7 @@ struct BrotliDecompressionSource : Source
                } catch (EndOfFile &) {
                    break;
                }
-                next_in = (const uint8_t *) buf.get();
+                next_in = reinterpret_cast<const uint8_t *>(buf.get());
            }

            if (!BrotliDecoderDecompressStream(
@ -238,7 +238,7 @@ struct BrotliCompressionSink : ChunkedCompressionSink

    void writeInternal(std::string_view data) override
    {
-        auto next_in = (const uint8_t *) data.data();
+        auto next_in = reinterpret_cast<const uint8_t *>(data.data());
        size_t avail_in = data.size();
        uint8_t * next_out = outbuf;
        size_t avail_out = sizeof(outbuf);
@ -254,7 +254,7 @@ struct BrotliCompressionSink : ChunkedCompressionSink
                throw CompressionError("error while compressing brotli compression");

            if (avail_out < sizeof(outbuf) || avail_in == 0) {
-                nextSink({(const char *) outbuf, sizeof(outbuf) - avail_out});
+                nextSink({reinterpret_cast<const char *>(outbuf), sizeof(outbuf) - avail_out});
                next_out = outbuf;
                avail_out = sizeof(outbuf);
            }
--- a/src/libutil/file-descriptor.cc
+++ b/src/libutil/file-descriptor.cc
@ -115,7 +115,7 @@ Generator<Bytes> drainFDSource(int fd, bool block)
                throw SysError("reading from file");
        }
        else if (rd == 0) break;
-        else co_yield std::span{(char *) buf.data(), (size_t) rd};
+        else co_yield std::span{reinterpret_cast<char *>(buf.data()), (size_t) rd};
    }
 }

--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@ -567,9 +567,8 @@ Path createTempDir(const Path & tmpRoot, const Path & prefix,
 std::pair<AutoCloseFD, Path> createTempFile(const Path & prefix)
 {
    Path tmpl(defaultTempDir() + "/" + prefix + ".XXXXXX");
-    // Strictly speaking, this is UB, but who cares...
    // FIXME: use O_TMPFILE.
-    AutoCloseFD fd(mkstemp((char *) tmpl.c_str()));
+    AutoCloseFD fd(mkstemp(tmpl.data()));
    if (!fd)
        throw SysError("creating temporary file '%s'", tmpl);
    closeOnExec(fd.get());
--- a/src/libutil/finally.hh
+++ b/src/libutil/finally.hh
@ -22,7 +22,7 @@ public:
    Finally(Finally &&other) : fun(std::move(other.fun)) {
        other.movedFrom = true;
    }
-    ~Finally() noexcept(false)
+    ~Finally() noexcept(noexcept(fun()))
    {
        try {
            if (!movedFrom)
--- a/src/libutil/hash.cc
+++ b/src/libutil/hash.cc
@ -18,10 +18,10 @@ namespace nix {

 static size_t regularHashSize(HashType type) {
    switch (type) {
-    case htMD5: return md5HashSize;
-    case htSHA1: return sha1HashSize;
-    case htSHA256: return sha256HashSize;
-    case htSHA512: return sha512HashSize;
+    case HashType::MD5: return md5HashSize;
+    case HashType::SHA1: return sha1HashSize;
+    case HashType::SHA256: return sha256HashSize;
+    case HashType::SHA512: return sha512HashSize;
    }
    abort();
 }
@ -109,34 +109,33 @@ static std::string printHash32(const Hash & hash)

 std::string printHash16or32(const Hash & hash)
 {
-    assert(hash.type);
-    return hash.to_string(hash.type == htMD5 ? Base16 : Base32, false);
+    return hash.to_string(hash.type == HashType::MD5 ? Base::Base16 : Base::Base32, false);
 }


 std::string Hash::to_string(Base base, bool includeType) const
 {
    std::string s;
-    if (base == SRI || includeType) {
+    if (base == Base::SRI || includeType) {
        s += printHashType(type);
-        s += base == SRI ? '-' : ':';
+        s += base == Base::SRI ? '-' : ':';
    }
    switch (base) {
-    case Base16:
+    case Base::Base16:
        s += printHash16(*this);
        break;
-    case Base32:
+    case Base::Base32:
        s += printHash32(*this);
        break;
-    case Base64:
-    case SRI:
-        s += base64Encode(std::string_view((const char *) hash, hashSize));
+    case Base::Base64:
+    case Base::SRI:
+        s += base64Encode(std::string_view(reinterpret_cast<const char *>(hash), hashSize));
        break;
    }
    return s;
 }

-Hash Hash::dummy(htSHA256);
+Hash Hash::dummy(HashType::SHA256);

 Hash Hash::parseSRI(std::string_view original) {
    auto rest = original;
@ -266,7 +265,7 @@ Hash newHashAllowEmpty(std::string_view hashStr, std::optional<HashType> ht)
        if (!ht)
            throw BadHash("empty hash requires explicit hash type");
        Hash h(*ht);
-        warn("found empty hash, assuming '%s'", h.to_string(SRI, true));
+        warn("found empty hash, assuming '%s'", h.to_string(Base::SRI, true));
        return h;
    } else
        return Hash::parseAny(hashStr, ht);
@ -284,29 +283,29 @@ union Ctx

 static void start(HashType ht, Ctx & ctx)
 {
-    if (ht == htMD5) MD5_Init(&ctx.md5);
-    else if (ht == htSHA1) SHA1_Init(&ctx.sha1);
-    else if (ht == htSHA256) SHA256_Init(&ctx.sha256);
-    else if (ht == htSHA512) SHA512_Init(&ctx.sha512);
+    if (ht == HashType::MD5) MD5_Init(&ctx.md5);
+    else if (ht == HashType::SHA1) SHA1_Init(&ctx.sha1);
+    else if (ht == HashType::SHA256) SHA256_Init(&ctx.sha256);
+    else if (ht == HashType::SHA512) SHA512_Init(&ctx.sha512);
 }


 static void update(HashType ht, Ctx & ctx,
    std::string_view data)
 {
-    if (ht == htMD5) MD5_Update(&ctx.md5, data.data(), data.size());
-    else if (ht == htSHA1) SHA1_Update(&ctx.sha1, data.data(), data.size());
-    else if (ht == htSHA256) SHA256_Update(&ctx.sha256, data.data(), data.size());
-    else if (ht == htSHA512) SHA512_Update(&ctx.sha512, data.data(), data.size());
+    if (ht == HashType::MD5) MD5_Update(&ctx.md5, data.data(), data.size());
+    else if (ht == HashType::SHA1) SHA1_Update(&ctx.sha1, data.data(), data.size());
+    else if (ht == HashType::SHA256) SHA256_Update(&ctx.sha256, data.data(), data.size());
+    else if (ht == HashType::SHA512) SHA512_Update(&ctx.sha512, data.data(), data.size());
 }


 static void finish(HashType ht, Ctx & ctx, unsigned char * hash)
 {
-    if (ht == htMD5) MD5_Final(hash, &ctx.md5);
-    else if (ht == htSHA1) SHA1_Final(hash, &ctx.sha1);
-    else if (ht == htSHA256) SHA256_Final(hash, &ctx.sha256);
-    else if (ht == htSHA512) SHA512_Final(hash, &ctx.sha512);
+    if (ht == HashType::MD5) MD5_Final(hash, &ctx.md5);
+    else if (ht == HashType::SHA1) SHA1_Final(hash, &ctx.sha1);
+    else if (ht == HashType::SHA256) SHA256_Final(hash, &ctx.sha256);
+    else if (ht == HashType::SHA512) SHA512_Final(hash, &ctx.sha512);
 }


@ -387,10 +386,10 @@ Hash compressHash(const Hash & hash, unsigned int newSize)

 std::optional<HashType> parseHashTypeOpt(std::string_view s)
 {
-    if (s == "md5") return htMD5;
-    else if (s == "sha1") return htSHA1;
-    else if (s == "sha256") return htSHA256;
-    else if (s == "sha512") return htSHA512;
+    if (s == "md5") return HashType::MD5;
+    else if (s == "sha1") return HashType::SHA1;
+    else if (s == "sha256") return HashType::SHA256;
+    else if (s == "sha512") return HashType::SHA512;
    else return std::optional<HashType> {};
 }

@ -406,10 +405,10 @@ HashType parseHashType(std::string_view s)
 std::string_view printHashType(HashType ht)
 {
    switch (ht) {
-    case htMD5: return "md5";
-    case htSHA1: return "sha1";
-    case htSHA256: return "sha256";
-    case htSHA512: return "sha512";
+    case HashType::MD5: return "md5";
+    case HashType::SHA1: return "sha1";
+    case HashType::SHA256: return "sha256";
+    case HashType::SHA512: return "sha512";
    default:
        // illegal hash type enum value internally, as opposed to external input
        // which should be validated with nice error message.
--- a/src/libutil/hash.hh
+++ b/src/libutil/hash.hh
@ -12,7 +12,7 @@ namespace nix {
 MakeError(BadHash, Error);


-enum HashType : char { htMD5 = 42, htSHA1, htSHA256, htSHA512 };
+enum class HashType : char { MD5 = 42, SHA1, SHA256, SHA512 };


 const int md5HashSize = 16;
@ -24,7 +24,7 @@ extern std::set<std::string> hashTypes;

 extern const std::string base32Chars;

-enum Base : int { Base64, Base32, Base16, SRI };
+enum class Base : int { Base64, Base32, Base16, SRI };


 struct Hash
@ -119,12 +119,12 @@ public:

    std::string gitRev() const
    {
-        return to_string(Base16, false);
+        return to_string(Base::Base16, false);
    }

    std::string gitShortRev() const
    {
-        return std::string(to_string(Base16, false), 0, 7);
+        return std::string(to_string(Base::Base16, false), 0, 7);
    }

    static Hash dummy;
--- a/src/libutil/meson.build
+++ b/src/libutil/meson.build
@ -52,6 +52,7 @@ libutil_headers = files(
  'box_ptr.hh',
  'canon-path.hh',
  'cgroup.hh',
+  'charptr-cast.hh',
  'checked-arithmetic.hh',
  'chunked-vector.hh',
  'closure.hh',
--- a/src/libutil/processes.cc
+++ b/src/libutil/processes.cc
@ -9,9 +9,7 @@
 #include <cerrno>
 #include <cstdlib>
 #include <cstring>
-#include <future>
 #include <iostream>
-#include <thread>

 #include <grp.h>
 #include <sys/types.h>
@ -176,7 +174,7 @@ static pid_t doFork(std::function<void()> fun)
 #if __linux__
 static int childEntry(void * arg)
 {
-    auto main = (std::function<void()> *) arg;
+    auto main = static_cast<std::function<void()> *>(arg);
    (*main)();
    return 1;
 }
@ -212,8 +210,8 @@ Pid startProcess(std::function<void()> fun, const ProcessOptions & options)
        assert(!(options.cloneFlags & CLONE_VM));

        size_t stackSize = 1 * 1024 * 1024;
-        auto stack = (char *) mmap(0, stackSize,
-            PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0);
+        auto stack = static_cast<char *>(mmap(0, stackSize,
+            PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0));
        if (stack == MAP_FAILED) throw SysError("allocating stack");

        Finally freeStack([&]() { munmap(stack, stackSize); });
--- a/src/libutil/strings.cc
+++ b/src/libutil/strings.cc
@ -8,7 +8,8 @@ namespace nix {
 std::vector<char *> stringsToCharPtrs(const Strings & ss)
 {
    std::vector<char *> res;
-    for (auto & s : ss) res.push_back((char *) s.c_str());
+    // This is const cast since this exists for OS APIs that want char *
+    for (auto & s : ss) res.push_back(const_cast<char *>(s.data()));
    res.push_back(0);
    return res;
 }
--- a/src/libutil/strings.hh
+++ b/src/libutil/strings.hh
@ -20,6 +20,8 @@ constexpr char treeNull[] = "    ";
 * Convert a list of strings to a null-terminated vector of `char
 * *`s. The result must not be accessed beyond the lifetime of the
 * list of strings.
+ *
+ * Modifying the resulting array elements violates the constness of ss.
 */
 std::vector<char *> stringsToCharPtrs(const Strings & ss);

--- a/src/libutil/tarfile.cc
+++ b/src/libutil/tarfile.cc
@ -15,11 +15,11 @@ static int callback_open(struct archive *, void * self)

 static ssize_t callback_read(struct archive * archive, void * _self, const void * * buffer)
 {
-    auto self = (TarArchive *) _self;
+    auto self = static_cast<TarArchive *>(_self);
    *buffer = self->buffer.data();

    try {
-        return self->source->read((char *) self->buffer.data(), self->buffer.size());
+        return self->source->read(reinterpret_cast<char *>(self->buffer.data()), self->buffer.size());
    } catch (EndOfFile &) {
        return 0;
    } catch (std::exception & err) {
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@ -404,8 +404,8 @@ static void opQuery(Strings opFlags, Strings opArgs)
                for (auto & j : maybeUseOutputs(store->followLinksToStorePath(i), useOutput, forceRealise)) {
                    auto info = store->queryPathInfo(j);
                    if (query == qHash) {
-                        assert(info->narHash.type == htSHA256);
-                        cout << fmt("%s\n", info->narHash.to_string(Base32, true));
+                        assert(info->narHash.type == HashType::SHA256);
+                        cout << fmt("%s\n", info->narHash.to_string(Base::Base32, true));
                    } else if (query == qSize)
                        cout << fmt("%d\n", info->narSize);
                }
@ -540,7 +540,7 @@ static void registerValidity(bool reregister, bool hashGiven, bool canonicalise)
            if (canonicalise)
                canonicalisePathMetaData(store->printStorePath(info->path), {});
            if (!hashGiven) {
-                HashResult hash = hashPath(htSHA256, store->printStorePath(info->path));
+                HashResult hash = hashPath(HashType::SHA256, store->printStorePath(info->path));
                info->narHash = hash.first;
                info->narSize = hash.second;
            }
@ -768,8 +768,8 @@ static void opVerifyPath(Strings opFlags, Strings opArgs)
        if (current.first != info->narHash) {
            printError("path '%s' was modified! expected hash '%s', got '%s'",
                store->printStorePath(path),
-                info->narHash.to_string(Base32, true),
-                current.first.to_string(Base32, true));
+                info->narHash.to_string(Base::Base32, true),
+                current.first.to_string(Base::Base32, true));
            status = 1;
        }
    }
@ -970,7 +970,7 @@ static void opServe(Strings opFlags, Strings opArgs)
                auto deriver = readString(in);
                ValidPathInfo info {
                    store->parseStorePath(path),
-                    Hash::parseAny(readString(in), htSHA256),
+                    Hash::parseAny(readString(in), HashType::SHA256),
                };
                if (deriver != "")
                    info.deriver = store->parseStorePath(deriver);
--- a/src/nix/add-to-store.cc
+++ b/src/nix/add-to-store.cc
@ -32,11 +32,11 @@ struct CmdAddToStore : MixDryRun, StoreCommand
        StringSink sink;
        sink << dumpPath(path);

-        auto narHash = hashString(htSHA256, sink.s);
+        auto narHash = hashString(HashType::SHA256, sink.s);

        Hash hash = narHash;
        if (ingestionMethod == FileIngestionMethod::Flat) {
-            HashSink hsink(htSHA256);
+            HashSink hsink(HashType::SHA256);
            hsink << readFileSource(path);
            hash = hsink.finish().first;
        }
--- a/src/nix/daemon.cc
+++ b/src/nix/daemon.cc
@ -316,7 +316,7 @@ static void daemonLoop(std::optional<TrustedFlag> forceTrustClientOpt)
            socklen_t remoteAddrLen = sizeof(remoteAddr);

            AutoCloseFD remote{accept(fdSocket.get(),
-                    (struct sockaddr *) &remoteAddr, &remoteAddrLen)};
+                    reinterpret_cast<struct sockaddr *>(&remoteAddr), &remoteAddrLen)};
            checkInterrupt();
            if (!remote) {
                if (errno == EINTR) continue;
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@ -226,7 +226,7 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
            j["url"] = flake.lockedRef.to_string(); // FIXME: rename to lockedUrl
            j["locked"] = fetchers::attrsToJSON(flake.lockedRef.toAttrs());
            if (auto rev = flake.lockedRef.input.getRev())
-                j["revision"] = rev->to_string(Base16, false);
+                j["revision"] = rev->to_string(Base::Base16, false);
            if (auto dirtyRev = fetchers::maybeGetStrAttr(flake.lockedRef.toAttrs(), "dirtyRev"))
                j["dirtyRevision"] = *dirtyRev;
            if (auto revCount = flake.lockedRef.input.getRevCount())
@ -253,7 +253,7 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
            if (auto rev = flake.lockedRef.input.getRev())
                logger->cout(
                    ANSI_BOLD "Revision:" ANSI_NORMAL "      %s",
-                    rev->to_string(Base16, false));
+                    rev->to_string(Base::Base16, false));
            if (auto dirtyRev = fetchers::maybeGetStrAttr(flake.lockedRef.toAttrs(), "dirtyRev"))
                logger->cout(
                    ANSI_BOLD "Revision:" ANSI_NORMAL "      %s",
@ -1434,13 +1434,13 @@ struct CmdFlakePrefetch : FlakeCommand, MixJSON
        if (json) {
            auto res = nlohmann::json::object();
            res["storePath"] = store->printStorePath(tree.storePath);
-            res["hash"] = hash.to_string(SRI, true);
+            res["hash"] = hash.to_string(Base::SRI, true);
            logger->cout(res.dump());
        } else {
            notice("Downloaded '%s' to '%s' (hash '%s').",
                lockedRef.to_string(),
                store->printStorePath(tree.storePath),
-                hash.to_string(SRI, true));
+                hash.to_string(Base::SRI, true));
        }
    }
 };
--- a/src/nix/hash.cc
+++ b/src/nix/hash.cc
@ -11,9 +11,9 @@ using namespace nix;
 struct CmdHashBase : Command
 {
    FileIngestionMethod mode;
-    Base base = SRI;
+    Base base = Base::SRI;
    bool truncate = false;
-    HashType ht = htSHA256;
+    HashType ht = HashType::SHA256;
    std::vector<std::string> paths;
    std::optional<std::string> modulus;

@ -22,25 +22,25 @@ struct CmdHashBase : Command
        addFlag({
            .longName = "sri",
            .description = "Print the hash in SRI format.",
-            .handler = {&base, SRI},
+            .handler = {&base, Base::SRI},
        });

        addFlag({
            .longName = "base64",
            .description = "Print the hash in base-64 format.",
-            .handler = {&base, Base64},
+            .handler = {&base, Base::Base64},
        });

        addFlag({
            .longName = "base32",
            .description = "Print the hash in base-32 (Nix-specific) format.",
-            .handler = {&base, Base32},
+            .handler = {&base, Base::Base32},
        });

        addFlag({
            .longName = "base16",
            .description = "Print the hash in base-16 format.",
-            .handler = {&base, Base16},
+            .handler = {&base, Base::Base16},
        });

        addFlag(Flag::mkHashTypeFlag("type", &ht));
@ -90,7 +90,7 @@ struct CmdHashBase : Command
                ? computeHashModulo(ht, *modulus, source).first
                : hashSource(ht, source).first;
            if (truncate && h.hashSize > 20) h = compressHash(h, 20);
-            logger->cout(h.to_string(base, base == SRI));
+            logger->cout(h.to_string(base, base == Base::SRI));
        }
    }
 };
@ -110,16 +110,16 @@ struct CmdToBase : Command
    std::string description() override
    {
        return fmt("convert a hash to %s representation",
-            base == Base16 ? "base-16" :
-            base == Base32 ? "base-32" :
-            base == Base64 ? "base-64" :
+            base == Base::Base16 ? "base-16" :
+            base == Base::Base32 ? "base-32" :
+            base == Base::Base64 ? "base-64" :
            "SRI");
    }

    void run() override
    {
        for (auto s : args)
-            logger->cout(Hash::parseAny(s, ht).to_string(base, base == SRI));
+            logger->cout(Hash::parseAny(s, ht).to_string(base, base == Base::SRI));
    }
 };

@ -129,10 +129,10 @@ struct CmdHash : NixMultiCommand
        : MultiCommand({
                {"file", []() { return make_ref<CmdHashBase>(FileIngestionMethod::Flat);; }},
                {"path", []() { return make_ref<CmdHashBase>(FileIngestionMethod::Recursive); }},
-                {"to-base16", []() { return make_ref<CmdToBase>(Base16); }},
-                {"to-base32", []() { return make_ref<CmdToBase>(Base32); }},
-                {"to-base64", []() { return make_ref<CmdToBase>(Base64); }},
-                {"to-sri", []() { return make_ref<CmdToBase>(SRI); }},
+                {"to-base16", []() { return make_ref<CmdToBase>(Base::Base16); }},
+                {"to-base32", []() { return make_ref<CmdToBase>(Base::Base32); }},
+                {"to-base64", []() { return make_ref<CmdToBase>(Base::Base64); }},
+                {"to-sri", []() { return make_ref<CmdToBase>(Base::SRI); }},
          })
    { }

@ -158,7 +158,7 @@ static int compatNixHash(int argc, char * * argv)
 {
    std::optional<HashType> ht;
    bool flat = false;
-    Base base = Base16;
+    Base base = Base::Base16;
    bool truncate = false;
    enum { opHash, opTo } op = opHash;
    std::vector<std::string> ss;
@ -169,10 +169,10 @@ static int compatNixHash(int argc, char * * argv)
        else if (*arg == "--version")
            printVersion("nix-hash");
        else if (*arg == "--flat") flat = true;
-        else if (*arg == "--base16") base = Base16;
-        else if (*arg == "--base32") base = Base32;
-        else if (*arg == "--base64") base = Base64;
-        else if (*arg == "--sri") base = SRI;
+        else if (*arg == "--base16") base = Base::Base16;
+        else if (*arg == "--base32") base = Base::Base32;
+        else if (*arg == "--base64") base = Base::Base64;
+        else if (*arg == "--sri") base = Base::SRI;
        else if (*arg == "--truncate") truncate = true;
        else if (*arg == "--type") {
            std::string s = getArg(*arg, arg, end);
@ -180,19 +180,19 @@ static int compatNixHash(int argc, char * * argv)
        }
        else if (*arg == "--to-base16") {
            op = opTo;
-            base = Base16;
+            base = Base::Base16;
        }
        else if (*arg == "--to-base32") {
            op = opTo;
-            base = Base32;
+            base = Base::Base32;
        }
        else if (*arg == "--to-base64") {
            op = opTo;
-            base = Base64;
+            base = Base::Base64;
        }
        else if (*arg == "--to-sri") {
            op = opTo;
-            base = SRI;
+            base = Base::SRI;
        }
        else if (*arg != "" && arg->at(0) == '-')
            return false;
@ -203,7 +203,7 @@ static int compatNixHash(int argc, char * * argv)

    if (op == opHash) {
        CmdHashBase cmd(flat ? FileIngestionMethod::Flat : FileIngestionMethod::Recursive);
-        if (!ht.has_value()) ht = htMD5;
+        if (!ht.has_value()) ht = HashType::MD5;
        cmd.ht = ht.value();
        cmd.base = base;
        cmd.truncate = truncate;
--- a/src/nix/main.cc
+++ b/src/nix/main.cc
@ -1,5 +1,3 @@
-#include <algorithm>
-
 #include "args/root.hh"
 #include "command.hh"
 #include "common-args.hh"
@ -62,12 +60,12 @@ static bool haveInternet()
    for (auto i = addrs; i; i = i->ifa_next) {
        if (!i->ifa_addr) continue;
        if (i->ifa_addr->sa_family == AF_INET) {
-            if (ntohl(((sockaddr_in *) i->ifa_addr)->sin_addr.s_addr) != INADDR_LOOPBACK) {
+            if (ntohl(reinterpret_cast<sockaddr_in *>(i->ifa_addr)->sin_addr.s_addr) != INADDR_LOOPBACK) {
                return true;
            }
        } else if (i->ifa_addr->sa_family == AF_INET6) {
-            if (!IN6_IS_ADDR_LOOPBACK(&((sockaddr_in6 *) i->ifa_addr)->sin6_addr) &&
-                !IN6_IS_ADDR_LINKLOCAL(&((sockaddr_in6 *) i->ifa_addr)->sin6_addr))
+            if (!IN6_IS_ADDR_LOOPBACK(&reinterpret_cast<sockaddr_in6 *>(i->ifa_addr)->sin6_addr) &&
+                !IN6_IS_ADDR_LINKLOCAL(&reinterpret_cast<sockaddr_in6 *>(i->ifa_addr)->sin6_addr))
                return true;
        }
    }
--- a/src/nix/path-info.cc
+++ b/src/nix/path-info.cc
@ -90,7 +90,7 @@ struct CmdPathInfo : StorePathsCommand, MixJSON
            std::cout << store->pathInfoToJSON(
                // FIXME: preserve order?
                StorePathSet(storePaths.begin(), storePaths.end()),
-                true, showClosureSize, SRI, AllowInvalid).dump();
+                true, showClosureSize, Base::SRI, AllowInvalid).dump();
        }

        else {
--- a/src/nix/prefetch.cc
+++ b/src/nix/prefetch.cc
@ -133,7 +133,7 @@ std::tuple<StorePath, Hash> prefetchFile(
 static int main_nix_prefetch_url(int argc, char * * argv)
 {
    {
-        HashType ht = htSHA256;
+        HashType ht = HashType::SHA256;
        std::vector<std::string> args;
        bool printPath = getEnv("PRINT_PATH") == "1";
        bool fromExpr = false;
@ -256,7 +256,7 @@ struct CmdStorePrefetchFile : StoreCommand, MixJSON
    bool executable = false;
    bool unpack = false;
    std::optional<std::string> name;
-    HashType hashType = htSHA256;
+    HashType hashType = HashType::SHA256;
    std::optional<Hash> expectedHash;

    CmdStorePrefetchFile()
@ -316,13 +316,13 @@ struct CmdStorePrefetchFile : StoreCommand, MixJSON
        if (json) {
            auto res = nlohmann::json::object();
            res["storePath"] = store->printStorePath(storePath);
-            res["hash"] = hash.to_string(SRI, true);
+            res["hash"] = hash.to_string(Base::SRI, true);
            logger->cout(res.dump());
        } else {
            notice("Downloaded '%s' to '%s' (hash '%s').",
                url,
                store->printStorePath(storePath),
-                hash.to_string(SRI, true));
+                hash.to_string(Base::SRI, true));
        }
    }
 };
--- a/src/nix/verify.cc
+++ b/src/nix/verify.cc
@ -109,8 +109,8 @@ struct CmdVerify : StorePathsCommand
                        act2.result(resCorruptedPath, store->printStorePath(info->path));
                        printError("path '%s' was modified! expected hash '%s', got '%s'",
                            store->printStorePath(info->path),
-                            info->narHash.to_string(Base32, true),
-                            hash.first.to_string(Base32, true));
+                            info->narHash.to_string(Base::Base32, true),
+                            hash.first.to_string(Base::Base32, true));
                    }
                }

--- a/src/nix/why-depends.cc
+++ b/src/nix/why-depends.cc
@ -171,7 +171,7 @@ struct CmdWhyDepends : SourceExprCommand, MixOperateOnOptions
           and `dependency`. */
        std::function<void(Node &, const std::string &, const std::string &)> printNode;

-        struct BailOut { };
+        struct BailOut : std::exception { };

        printNode = [&](Node & node, const std::string & firstPad, const std::string & tailPad) {
            auto pathS = store->printStorePath(node.path);
--- a/tests/unit/libstore/common-protocol.cc
+++ b/tests/unit/libstore/common-protocol.cc
@ -102,15 +102,15 @@ CHARACTERIZATION_TEST(
    (std::tuple<ContentAddress, ContentAddress, ContentAddress> {
        ContentAddress {
            .method = TextIngestionMethod {},
-            .hash = hashString(HashType::htSHA256, "Derive(...)"),
+            .hash = hashString(HashType::SHA256, "Derive(...)"),
        },
        ContentAddress {
            .method = FileIngestionMethod::Flat,
-            .hash = hashString(HashType::htSHA1, "blob blob..."),
+            .hash = hashString(HashType::SHA1, "blob blob..."),
        },
        ContentAddress {
            .method = FileIngestionMethod::Recursive,
-            .hash = hashString(HashType::htSHA256, "(...)"),
+            .hash = hashString(HashType::SHA256, "(...)"),
        },
    }))

@ -197,7 +197,7 @@ CHARACTERIZATION_TEST(
        std::optional {
            ContentAddress {
                .method = FileIngestionMethod::Flat,
-                .hash = hashString(HashType::htSHA1, "blob blob..."),
+                .hash = hashString(HashType::SHA1, "blob blob..."),
            },
        },
    }))
--- a/tests/unit/libstore/derivation.cc
+++ b/tests/unit/libstore/derivation.cc
@ -148,7 +148,7 @@ TEST_JSON(DynDerivationTest, caFixedText,
 TEST_JSON(CaDerivationTest, caFloating,
    (DerivationOutput::CAFloating {
        .method = FileIngestionMethod::Recursive,
-        .hashType = htSHA256,
+        .hashType = HashType::SHA256,
    }),
    "drv-name", "output-name")

@ -159,7 +159,7 @@ TEST_JSON(DerivationTest, deferred,
 TEST_JSON(ImpureDerivationTest, impure,
    (DerivationOutput::Impure {
        .method = FileIngestionMethod::Recursive,
-        .hashType = htSHA256,
+        .hashType = HashType::SHA256,
    }),
    "drv-name", "output-name")

--- a/tests/unit/libstore/filetransfer.cc
+++ b/tests/unit/libstore/filetransfer.cc
@ -6,7 +6,6 @@
 #include <future>
 #include <gtest/gtest.h>
 #include <netinet/in.h>
-#include <stdexcept>
 #include <string>
 #include <string_view>
 #include <sys/poll.h>
@ -130,7 +129,7 @@ serveHTTP(std::string status, std::string headers, std::function<std::string()>

 TEST(FileTransfer, exceptionAbortsDownload)
 {
-    struct Done
+    struct Done : std::exception
    {};

    auto ft = makeFileTransfer();
--- a/tests/unit/libstore/serve-protocol.cc
+++ b/tests/unit/libstore/serve-protocol.cc
@ -53,15 +53,15 @@ VERSIONED_CHARACTERIZATION_TEST(
    (std::tuple<ContentAddress, ContentAddress, ContentAddress> {
        ContentAddress {
            .method = TextIngestionMethod {},
-            .hash = hashString(HashType::htSHA256, "Derive(...)"),
+            .hash = hashString(HashType::SHA256, "Derive(...)"),
        },
        ContentAddress {
            .method = FileIngestionMethod::Flat,
-            .hash = hashString(HashType::htSHA1, "blob blob..."),
+            .hash = hashString(HashType::SHA1, "blob blob..."),
        },
        ContentAddress {
            .method = FileIngestionMethod::Recursive,
-            .hash = hashString(HashType::htSHA256, "(...)"),
+            .hash = hashString(HashType::SHA256, "(...)"),
        },
    }))

@ -278,7 +278,7 @@ VERSIONED_CHARACTERIZATION_TEST(
                "foo",
                FixedOutputInfo {
                    .method = FileIngestionMethod::Recursive,
-                    .hash = hashString(HashType::htSHA256, "(...)"),
+                    .hash = hashString(HashType::SHA256, "(...)"),
                    .references = {
                        .others = {
                            StorePath {
@ -348,7 +348,7 @@ VERSIONED_CHARACTERIZATION_TEST(
        std::optional {
            ContentAddress {
                .method = FileIngestionMethod::Flat,
-                .hash = hashString(HashType::htSHA1, "blob blob..."),
+                .hash = hashString(HashType::SHA1, "blob blob..."),
            },
        },
    }))
--- a/tests/unit/libstore/worker-protocol.cc
+++ b/tests/unit/libstore/worker-protocol.cc
@ -55,15 +55,15 @@ VERSIONED_CHARACTERIZATION_TEST(
    (std::tuple<ContentAddress, ContentAddress, ContentAddress> {
        ContentAddress {
            .method = TextIngestionMethod {},
-            .hash = hashString(HashType::htSHA256, "Derive(...)"),
+            .hash = hashString(HashType::SHA256, "Derive(...)"),
        },
        ContentAddress {
            .method = FileIngestionMethod::Flat,
-            .hash = hashString(HashType::htSHA1, "blob blob..."),
+            .hash = hashString(HashType::SHA1, "blob blob..."),
        },
        ContentAddress {
            .method = FileIngestionMethod::Recursive,
-            .hash = hashString(HashType::htSHA256, "(...)"),
+            .hash = hashString(HashType::SHA256, "(...)"),
        },
    }))

@ -417,7 +417,7 @@ VERSIONED_CHARACTERIZATION_TEST(
                "foo",
                FixedOutputInfo {
                    .method = FileIngestionMethod::Recursive,
-                    .hash = hashString(HashType::htSHA256, "(...)"),
+                    .hash = hashString(HashType::SHA256, "(...)"),
                    .references = {
                        .others = {
                            StorePath {
@ -492,7 +492,7 @@ VERSIONED_CHARACTERIZATION_TEST(
        std::optional {
            ContentAddress {
                .method = FileIngestionMethod::Flat,
-                .hash = hashString(HashType::htSHA1, "blob blob..."),
+                .hash = hashString(HashType::SHA1, "blob blob..."),
            },
        },
    }))
--- a/tests/unit/libutil-support/tests/hash.cc
+++ b/tests/unit/libutil-support/tests/hash.cc
@ -11,11 +11,11 @@ using namespace nix;

 Gen<Hash> Arbitrary<Hash>::arbitrary()
 {
-    Hash prototype(htSHA1);
+    Hash prototype(HashType::SHA1);
    return
        gen::apply(
            [](const std::vector<uint8_t> & v) {
-                Hash hash(htSHA1);
+                Hash hash(HashType::SHA1);
                assert(v.size() == hash.hashSize);
                std::copy(v.begin(), v.end(), hash.hash);
                return hash;
--- a/tests/unit/libutil/closure.cc
+++ b/tests/unit/libutil/closure.cc
@ -28,7 +28,7 @@ TEST(closure, correctClosure) {
 }

 TEST(closure, properlyHandlesDirectExceptions) {
-    struct TestExn {};
+    struct TestExn : std::exception {};
    EXPECT_THROW(
        computeClosure<string>(
            {"A"},
--- a/tests/unit/libutil/generator.cc
+++ b/tests/unit/libutil/generator.cc
@ -85,6 +85,7 @@ TEST(Generator, nestsExceptions)
        co_yield 1;
        co_yield []() -> Generator<int> {
            co_yield 9;
+            // NOLINTNEXTLINE(hicpp-exception-baseclass)
            throw 1;
            co_yield 10;
        }();
@ -101,6 +102,7 @@ TEST(Generator, exception)
    {
        auto g = []() -> Generator<int> {
            co_yield 1;
+            // NOLINTNEXTLINE(hicpp-exception-baseclass)
            throw 1;
        }();

@ -110,6 +112,7 @@ TEST(Generator, exception)
    }
    {
        auto g = []() -> Generator<int> {
+            // NOLINTNEXTLINE(hicpp-exception-baseclass)
            throw 1;
            co_return;
        }();
@ -173,11 +176,13 @@ struct ThrowTransform

    int operator()(bool)
    {
+        // NOLINTNEXTLINE(hicpp-exception-baseclass)
        throw 2;
    }

    Generator<int, void> operator()(Generator<int> && inner)
    {
+        // NOLINTNEXTLINE(hicpp-exception-baseclass)
        throw false;
    }
 };
--- a/tests/unit/libutil/hash.cc
+++ b/tests/unit/libutil/hash.cc
@ -13,28 +13,28 @@ namespace nix {
    TEST(hashString, testKnownMD5Hashes1) {
        // values taken from: https://tools.ietf.org/html/rfc1321
        auto s1 = "";
-        auto hash = hashString(HashType::htMD5, s1);
+        auto hash = hashString(HashType::MD5, s1);
        ASSERT_EQ(hash.to_string(Base::Base16, true), "md5:d41d8cd98f00b204e9800998ecf8427e");
    }

    TEST(hashString, testKnownMD5Hashes2) {
        // values taken from: https://tools.ietf.org/html/rfc1321
        auto s2 = "abc";
-        auto hash = hashString(HashType::htMD5, s2);
+        auto hash = hashString(HashType::MD5, s2);
        ASSERT_EQ(hash.to_string(Base::Base16, true), "md5:900150983cd24fb0d6963f7d28e17f72");
    }

    TEST(hashString, testKnownSHA1Hashes1) {
        // values taken from: https://tools.ietf.org/html/rfc3174
        auto s = "abc";
-        auto hash = hashString(HashType::htSHA1, s);
+        auto hash = hashString(HashType::SHA1, s);
        ASSERT_EQ(hash.to_string(Base::Base16, true),"sha1:a9993e364706816aba3e25717850c26c9cd0d89d");
    }

    TEST(hashString, testKnownSHA1Hashes2) {
        // values taken from: https://tools.ietf.org/html/rfc3174
        auto s = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq";
-        auto hash = hashString(HashType::htSHA1, s);
+        auto hash = hashString(HashType::SHA1, s);
        ASSERT_EQ(hash.to_string(Base::Base16, true),"sha1:84983e441c3bd26ebaae4aa1f95129e5e54670f1");
    }

@ -42,7 +42,7 @@ namespace nix {
        // values taken from: https://tools.ietf.org/html/rfc4634
        auto s = "abc";

-        auto hash = hashString(HashType::htSHA256, s);
+        auto hash = hashString(HashType::SHA256, s);
        ASSERT_EQ(hash.to_string(Base::Base16, true),
                "sha256:ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad");
    }
@ -50,7 +50,7 @@ namespace nix {
    TEST(hashString, testKnownSHA256Hashes2) {
        // values taken from: https://tools.ietf.org/html/rfc4634
        auto s = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq";
-        auto hash = hashString(HashType::htSHA256, s);
+        auto hash = hashString(HashType::SHA256, s);
        ASSERT_EQ(hash.to_string(Base::Base16, true),
                "sha256:248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1");
    }
@ -58,7 +58,7 @@ namespace nix {
    TEST(hashString, testKnownSHA512Hashes1) {
        // values taken from: https://tools.ietf.org/html/rfc4634
        auto s = "abc";
-        auto hash = hashString(HashType::htSHA512, s);
+        auto hash = hashString(HashType::SHA512, s);
        ASSERT_EQ(hash.to_string(Base::Base16, true),
                "sha512:ddaf35a193617abacc417349ae20413112e6fa4e89a9"
                "7ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd"
@ -68,7 +68,7 @@ namespace nix {
        // values taken from: https://tools.ietf.org/html/rfc4634
        auto s = "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu";

-        auto hash = hashString(HashType::htSHA512, s);
+        auto hash = hashString(HashType::SHA512, s);
        ASSERT_EQ(hash.to_string(Base::Base16, true),
                "sha512:8e959b75dae313da8cf4f72814fc143f8f7779c6eb9f7fa1"
                "7299aeadb6889018501d289e4900f7e4331b99dec4b5433a"
--- a/tests/unit/libutil/tests.cc
+++ b/tests/unit/libutil/tests.cc
@ -29,12 +29,12 @@ namespace nix {
        char cwd[PATH_MAX+1];
        auto p = absPath("");

-        ASSERT_EQ(p, getcwd((char*)&cwd, PATH_MAX));
+        ASSERT_EQ(p, getcwd(cwd, PATH_MAX));
    }

    TEST(absPath, usesOptionalBasePathWhenGiven) {
        char _cwd[PATH_MAX+1];
-        char* cwd = getcwd((char*)&_cwd, PATH_MAX);
+        char* cwd = getcwd(_cwd, PATH_MAX);

        auto p = absPath("", cwd);

@ -43,7 +43,7 @@ namespace nix {

    TEST(absPath, isIdempotent) {
        char _cwd[PATH_MAX+1];
-        char* cwd = getcwd((char*)&_cwd, PATH_MAX);
+        char* cwd = getcwd(_cwd, PATH_MAX);
        auto p1 = absPath(cwd);
        auto p2 = absPath(p1);