FOD guessedUrl doesn't work with fetchers using __structuredAttrs #1175

New issue

Open

opened 2026-04-03 20:39:32 +00:00 by sersorrel · 1 comment

sersorrel commented

2026-04-03 20:39:32 +00:00

Describe the bug

Since nixpkgs@cd13136f036d, fetchurl uses __structuredAttrs; this propagates to things like fetchFromGitHub as well. I think this has broken the Lix feature where it tries to guess what URL a hash mismatch is related to.

Steps To Reproduce

$ nix repl nixpkgs
nix-repl> :b legacyPackages.${builtins.currentSystem}.fetchFromGitHub { owner = "keysmashes"; repo = "sys"; rev = "main"; hash = ""; }
source> structuredAttrs is enabled
source> trying https://github.com/keysmashes/sys/archive/main.tar.gz
source>   % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
source>                                  Dload  Upload  Total   Spent   Left   Speed
source>   0      0   0      0   0      0      0      0                              0
source> 100  47986   0  47986   0      0 112.2k      0                              0
source> unpacking source archive /build/download.tar.gz
error: hash mismatch in fixed-output derivation '/nix/store/9c7z1ac9n0ywbv600a44i68sgkjva8vv-source.drv':
           likely URL: (unknown)
            specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
                  got: sha256-pCcLjh0Ne6w/xBqnnbZiTddJLRbUJToijAeGgMMi1hM=
        expected path: /nix/store/bqfq4db6nwycmkdrql9igsbrayqsw3g2-source
             got path: /nix/store/qz6rhd31kd1kx8isz6qyy4vs3alw03c0-source

Expected behavior

$ nix repl nixpkgs
nix-repl> :b legacyPackages.${builtins.currentSystem}.fetchFromGitHub { owner = "keysmashes"; repo = "sys"; rev = "main"; hash = ""; }
...
error: hash mismatch in fixed-output derivation '/nix/store/1xw0ky4ncc0j2i36y1fa3zqqd6kga1l3-source.drv':
           likely URL: https://github.com/keysmashes/sys/archive/main.tar.gz
            specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
                  got: sha256-pCcLjh0Ne6w/xBqnnbZiTddJLRbUJToijAeGgMMi1hM=
        expected path: /nix/store/bqfq4db6nwycmkdrql9igsbrayqsw3g2-source
             got path: /nix/store/qz6rhd31kd1kx8isz6qyy4vs3alw03c0-source

`nix --version` output

nix (Lix, like Nix) 2.95.1
System type: x86_64-linux
Additional system types: i686-linux, x86_64-v1-linux, x86_64-v2-linux, x86_64-v3-linux
Features: gc, signed-caches
System configuration file: /etc/nix/nix.conf
User configuration files: /home/ash/.config/nix/nix.conf:/etc/xdg/nix/nix.conf:/home/ash/.nix-profile/etc/xdg/nix/nix.conf:/nix/profile/etc/xdg/nix/nix.conf:/home/ash/.local/state/nix/profile/etc/xdg/nix/nix.conf:/etc/profiles/per-user/ash/etc/xdg/nix/nix.conf:/nix/var/nix/profiles/default/etc/xdg/nix/nix.conf:/run/current-system/sw/etc/xdg/nix/nix.conf
Store directory: /nix/store
State directory: /nix/var/nix
Data directory: /nix/store/8ywqcanm1ggrrzl2fx22j6zd6gdl9x2w-lix-2.95.1/share

Additional context

If we look at the derivation, we can see the problem: instead of the URL being at env.urls, it's inside a JSONified string at env.__json.

$ nix derivation show /nix/store/9c7z1ac9n0ywbv600a44i68sgkjva8vv-source.drv | head
{
  "/nix/store/9c7z1ac9n0ywbv600a44i68sgkjva8vv-source.drv": {
    "args": [
      "-e",
      "/nix/store/l622p70vy8k5sh7y5wizi5f2mic6ynpg-source-stdenv.sh",
      "/nix/store/vvlgjnnch92k53af32iwim3d7jdxai3y-builder.sh"
    ],
    "builder": "/nix/store/v8sa6r6q037ihghxfbwzjj4p59v2x0pv-bash-5.3p9/bin/bash",
    "env": {
      "__json": "{\"SSL_CERT_FILE\":\"/nix/store/mg063aj0crwhchqayf2qbyf28k6mlrxm-nss-cacert-3.121/etc/ssl/certs/ca-bundle.crt\",\"buildInputs\":[],\"builder\":\"/nix/store/v8sa6r6q037ihghxfbwzjj4p59v2x0pv-bash-5.3p9/bin/bash\",\"cmakeFlags\":[],\"configureFlags\":[],\"curlOpts\":\"\",\"curlOptsList\":[],\"depsBuildBuild\":[],\"depsBuildBuildPropagated\":[],\"depsBuildTarget\":[],\"depsBuildTargetPropagated\":[],\"depsHostHost\":[],\"depsHostHostPropagated\":[],\"depsTargetTarget\":[],\"depsTargetTargetPropagated\":[],\"doCheck\":false,\"doInstallCheck\":false,\"downloadToTemp\":true,\"env\":{\"SSL_CERT_FILE\":\"/nix/store/mg063aj0crwhchqayf2qbyf28k6mlrxm-nss-cacert-3.121/etc/ssl/certs/ca-bundle.crt\"},\"executable\":false,\"extension\":\"tar.gz\",\"githubBase\":\"github.com\",\"hash\":\"sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\",\"impureEnvVars\":[\"http_proxy\",\"https_proxy\",\"ftp_proxy\",\"all_proxy\",\"no_proxy\",\"HTTP_PROXY\",\"HTTPS_PROXY\",\"FTP_PROXY\",\"ALL_PROXY\",\"NO_PROXY\",\"NIX_SSL_CERT_FILE\",\"NIX_CURL_FLAGS\",\"NIX_HASHED_MIRRORS\",\"NIX_CONNECT_TIMEOUT\",\"NIX_MIRRORS_alsa\",\"NIX_MIRRORS_apache\",\"NIX_MIRRORS_bioc\",\"NIX_MIRRORS_bitlbee\",\"NIX_MIRRORS_centos\",\"NIX_MIRRORS_cpan\",\"NIX_MIRRORS_cran\",\"NIX_MIRRORS_debian\",\"NIX_MIRRORS_dub\",\"NIX_MIRRORS_fedora\",\"NIX_MIRRORS_gcc\",\"NIX_MIRRORS_gentoo\",\"NIX_MIRRORS_gnome\",\"NIX_MIRRORS_gnu\",\"NIX_MIRRORS_gnupg\",\"NIX_MIRRORS_hackage\",\"NIX_MIRRORS_hashedMirrors\",\"NIX_MIRRORS_ibiblioPubLinux\",\"NIX_MIRRORS_imagemagick\",\"NIX_MIRRORS_kde\",\"NIX_MIRRORS_kernel\",\"NIX_MIRRORS_luarocks\",\"NIX_MIRRORS_maven\",\"NIX_MIRRORS_mozilla\",\"NIX_MIRRORS_mysql\",\"NIX_MIRRORS_openbsd\",\"NIX_MIRRORS_opensuse\",\"NIX_MIRRORS_osdn\",\"NIX_MIRRORS_postgresql\",\"NIX_MIRRORS_pypi\",\"NIX_MIRRORS_qt\",\"NIX_MIRRORS_sageupstream\",\"NIX_MIRRORS_samba\",\"NIX_MIRRORS_savannah\",\"NIX_MIRRORS_sourceforge\",\"NIX_MIRRORS_steamrt\",\"NIX_MIRRORS_tcsh\",\"NIX_MIRRORS_testpypi\",\"NIX_MIRRORS_ubuntu\",\"NIX_MIRRORS_xfce\",\"NIX_MIRRORS_xorg\"],\"mesonFlags\":[],\"mirrorsFile\":\"/nix/store/m1a6q6rclqyvsg8grsp3wr0nrmvc1h0v-mirrors-list\",\"name\":\"source\",\"nativeBuildInputs\":[\"/nix/store/vbzlwjmaacsrvs0qy4cmrbmphp37xh5p-curl-8.18.0-dev\"],\"nixpkgsVersion\":\"26.05\",\"outputChecks\":{\"out\":{}},\"outputHash\":\"sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\",\"outputHashMode\":\"recursive\",\"outputs\":[\"out\"],\"owner\":\"keysmashes\",\"patches\":[],\"postFetch\":\"unpackDir=\\\"$TMPDIR/unpack\\\"\\nmkdir \\\"$unpackDir\\\"\\ncd \\\"$unpackDir\\\"\\n\\nrenamed=\\\"$TMPDIR/download.tar.gz\\\"\\nmv \\\"$downloadedFile\\\" \\\"$renamed\\\"\\nunpackFile \\\"$renamed\\\"\\nchmod -R +w \\\"$unpackDir\\\"\\nif [ $(ls -A \\\"$unpackDir\\\" | wc -l) != 1 ]; then\\n  echo \\\"error: zip file must contain a single file or directory.\\\"\\n  echo \\\"hint: Pass stripRoot=false; to fetchzip to assume flat list of files.\\\"\\n  exit 1\\nfi\\nfn=$(cd \\\"$unpackDir\\\" && ls -A)\\nif [ -f \\\"$unpackDir/$fn\\\" ]; then\\n  mkdir $out\\nfi\\nmv \\\"$unpackDir/$fn\\\" \\\"$out\\\"\\n\\n\\nchmod 755 \\\"$out\\\"\\n\",\"preferHashedMirrors\":false,\"preferLocalBuild\":true,\"propagatedBuildInputs\":[],\"propagatedNativeBuildInputs\":[],\"recursiveHash\":true,\"repo\":\"sys\",\"rev\":\"main\",\"revCustom\":\"main\",\"showURLs\":false,\"stdenv\":\"/nix/store/s2grcjv8pklvkajk3mkh75aja5dppx6z-stdenv-linux\",\"strictDeps\":false,\"stripRoot\":true,\"system\":\"x86_64-linux\",\"urls\":[\"https://github.com/keysmashes/sys/archive/main.tar.gz\"]}",

Applying the following nixpkgs patch to (badly) revert the __structuredAttrs addition gets the URL-guessing working again:

diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index 228fcd2ed1..26c76fa447 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -1,4 +1,3 @@
-source "$NIX_ATTRS_SH_FILE"
 source $mirrorsFile
 
 # Normalize `curlOpts` as a string.
@@ -42,7 +41,6 @@
 fi
 
 curl+=(
-    "${curlOptsList[@]}"
     $curlOpts
     $NIX_CURL_FLAGS
 )
diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index ddd3075633..db22fe939e 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -169,7 +169,6 @@
 
       # Passthru information, if any.
       passthru ? { },
-
       # Doing the download on a remote machine just duplicates network
       # traffic, so don't do that by default
       preferLocalBuild ? true,
@@ -262,8 +261,6 @@
 
     derivationArgs
     // {
-      __structuredAttrs = true;
-
       name =
         if finalAttrs.pname or null != null && finalAttrs.version or null != null then
           "${finalAttrs.pname}-${finalAttrs.version}"
@@ -339,8 +336,9 @@
         ''
       ) curlOpts;
 
+      curlOptsList = lib.escapeShellArgs curlOptsList;
+
       inherit
-        curlOptsList
         downloadToTemp
         executable
         mirrorsFile

## Describe the bug Since [nixpkgs@cd13136f036d](https://github.com/NixOS/nixpkgs/commit/cd13136f036deb139311bbbb1d18544af42eec24), fetchurl uses __structuredAttrs; this propagates to things like fetchFromGitHub as well. I think this has broken the Lix feature where it tries to guess what URL a hash mismatch is related to. ## Steps To Reproduce ``` $ nix repl nixpkgs nix-repl> :b legacyPackages.${builtins.currentSystem}.fetchFromGitHub { owner = "keysmashes"; repo = "sys"; rev = "main"; hash = ""; } source> structuredAttrs is enabled source> trying https://github.com/keysmashes/sys/archive/main.tar.gz source> % Total % Received % Xferd Average Speed Time Time Time Current source> Dload Upload Total Spent Left Speed source> 0 0 0 0 0 0 0 0 0 source> 100 47986 0 47986 0 0 112.2k 0 0 source> unpacking source archive /build/download.tar.gz error: hash mismatch in fixed-output derivation '/nix/store/9c7z1ac9n0ywbv600a44i68sgkjva8vv-source.drv': likely URL: (unknown) specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= got: sha256-pCcLjh0Ne6w/xBqnnbZiTddJLRbUJToijAeGgMMi1hM= expected path: /nix/store/bqfq4db6nwycmkdrql9igsbrayqsw3g2-source got path: /nix/store/qz6rhd31kd1kx8isz6qyy4vs3alw03c0-source ``` ## Expected behavior ``` $ nix repl nixpkgs nix-repl> :b legacyPackages.${builtins.currentSystem}.fetchFromGitHub { owner = "keysmashes"; repo = "sys"; rev = "main"; hash = ""; } ... error: hash mismatch in fixed-output derivation '/nix/store/1xw0ky4ncc0j2i36y1fa3zqqd6kga1l3-source.drv': likely URL: https://github.com/keysmashes/sys/archive/main.tar.gz specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= got: sha256-pCcLjh0Ne6w/xBqnnbZiTddJLRbUJToijAeGgMMi1hM= expected path: /nix/store/bqfq4db6nwycmkdrql9igsbrayqsw3g2-source got path: /nix/store/qz6rhd31kd1kx8isz6qyy4vs3alw03c0-source ``` ## `nix --version` output ``` nix (Lix, like Nix) 2.95.1 System type: x86_64-linux Additional system types: i686-linux, x86_64-v1-linux, x86_64-v2-linux, x86_64-v3-linux Features: gc, signed-caches System configuration file: /etc/nix/nix.conf User configuration files: /home/ash/.config/nix/nix.conf:/etc/xdg/nix/nix.conf:/home/ash/.nix-profile/etc/xdg/nix/nix.conf:/nix/profile/etc/xdg/nix/nix.conf:/home/ash/.local/state/nix/profile/etc/xdg/nix/nix.conf:/etc/profiles/per-user/ash/etc/xdg/nix/nix.conf:/nix/var/nix/profiles/default/etc/xdg/nix/nix.conf:/run/current-system/sw/etc/xdg/nix/nix.conf Store directory: /nix/store State directory: /nix/var/nix Data directory: /nix/store/8ywqcanm1ggrrzl2fx22j6zd6gdl9x2w-lix-2.95.1/share ``` ## Additional context If we look at the derivation, we can see the problem: instead of the URL being at `env.urls`, it's inside a JSONified string at `env.__json`. ``` $ nix derivation show /nix/store/9c7z1ac9n0ywbv600a44i68sgkjva8vv-source.drv | head { "/nix/store/9c7z1ac9n0ywbv600a44i68sgkjva8vv-source.drv": { "args": [ "-e", "/nix/store/l622p70vy8k5sh7y5wizi5f2mic6ynpg-source-stdenv.sh", "/nix/store/vvlgjnnch92k53af32iwim3d7jdxai3y-builder.sh" ], "builder": "/nix/store/v8sa6r6q037ihghxfbwzjj4p59v2x0pv-bash-5.3p9/bin/bash", "env": { "__json": "{\"SSL_CERT_FILE\":\"/nix/store/mg063aj0crwhchqayf2qbyf28k6mlrxm-nss-cacert-3.121/etc/ssl/certs/ca-bundle.crt\",\"buildInputs\":[],\"builder\":\"/nix/store/v8sa6r6q037ihghxfbwzjj4p59v2x0pv-bash-5.3p9/bin/bash\",\"cmakeFlags\":[],\"configureFlags\":[],\"curlOpts\":\"\",\"curlOptsList\":[],\"depsBuildBuild\":[],\"depsBuildBuildPropagated\":[],\"depsBuildTarget\":[],\"depsBuildTargetPropagated\":[],\"depsHostHost\":[],\"depsHostHostPropagated\":[],\"depsTargetTarget\":[],\"depsTargetTargetPropagated\":[],\"doCheck\":false,\"doInstallCheck\":false,\"downloadToTemp\":true,\"env\":{\"SSL_CERT_FILE\":\"/nix/store/mg063aj0crwhchqayf2qbyf28k6mlrxm-nss-cacert-3.121/etc/ssl/certs/ca-bundle.crt\"},\"executable\":false,\"extension\":\"tar.gz\",\"githubBase\":\"github.com\",\"hash\":\"sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\",\"impureEnvVars\":[\"http_proxy\",\"https_proxy\",\"ftp_proxy\",\"all_proxy\",\"no_proxy\",\"HTTP_PROXY\",\"HTTPS_PROXY\",\"FTP_PROXY\",\"ALL_PROXY\",\"NO_PROXY\",\"NIX_SSL_CERT_FILE\",\"NIX_CURL_FLAGS\",\"NIX_HASHED_MIRRORS\",\"NIX_CONNECT_TIMEOUT\",\"NIX_MIRRORS_alsa\",\"NIX_MIRRORS_apache\",\"NIX_MIRRORS_bioc\",\"NIX_MIRRORS_bitlbee\",\"NIX_MIRRORS_centos\",\"NIX_MIRRORS_cpan\",\"NIX_MIRRORS_cran\",\"NIX_MIRRORS_debian\",\"NIX_MIRRORS_dub\",\"NIX_MIRRORS_fedora\",\"NIX_MIRRORS_gcc\",\"NIX_MIRRORS_gentoo\",\"NIX_MIRRORS_gnome\",\"NIX_MIRRORS_gnu\",\"NIX_MIRRORS_gnupg\",\"NIX_MIRRORS_hackage\",\"NIX_MIRRORS_hashedMirrors\",\"NIX_MIRRORS_ibiblioPubLinux\",\"NIX_MIRRORS_imagemagick\",\"NIX_MIRRORS_kde\",\"NIX_MIRRORS_kernel\",\"NIX_MIRRORS_luarocks\",\"NIX_MIRRORS_maven\",\"NIX_MIRRORS_mozilla\",\"NIX_MIRRORS_mysql\",\"NIX_MIRRORS_openbsd\",\"NIX_MIRRORS_opensuse\",\"NIX_MIRRORS_osdn\",\"NIX_MIRRORS_postgresql\",\"NIX_MIRRORS_pypi\",\"NIX_MIRRORS_qt\",\"NIX_MIRRORS_sageupstream\",\"NIX_MIRRORS_samba\",\"NIX_MIRRORS_savannah\",\"NIX_MIRRORS_sourceforge\",\"NIX_MIRRORS_steamrt\",\"NIX_MIRRORS_tcsh\",\"NIX_MIRRORS_testpypi\",\"NIX_MIRRORS_ubuntu\",\"NIX_MIRRORS_xfce\",\"NIX_MIRRORS_xorg\"],\"mesonFlags\":[],\"mirrorsFile\":\"/nix/store/m1a6q6rclqyvsg8grsp3wr0nrmvc1h0v-mirrors-list\",\"name\":\"source\",\"nativeBuildInputs\":[\"/nix/store/vbzlwjmaacsrvs0qy4cmrbmphp37xh5p-curl-8.18.0-dev\"],\"nixpkgsVersion\":\"26.05\",\"outputChecks\":{\"out\":{}},\"outputHash\":\"sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\",\"outputHashMode\":\"recursive\",\"outputs\":[\"out\"],\"owner\":\"keysmashes\",\"patches\":[],\"postFetch\":\"unpackDir=\\\"$TMPDIR/unpack\\\"\\nmkdir \\\"$unpackDir\\\"\\ncd \\\"$unpackDir\\\"\\n\\nrenamed=\\\"$TMPDIR/download.tar.gz\\\"\\nmv \\\"$downloadedFile\\\" \\\"$renamed\\\"\\nunpackFile \\\"$renamed\\\"\\nchmod -R +w \\\"$unpackDir\\\"\\nif [ $(ls -A \\\"$unpackDir\\\" | wc -l) != 1 ]; then\\n echo \\\"error: zip file must contain a single file or directory.\\\"\\n echo \\\"hint: Pass stripRoot=false; to fetchzip to assume flat list of files.\\\"\\n exit 1\\nfi\\nfn=$(cd \\\"$unpackDir\\\" && ls -A)\\nif [ -f \\\"$unpackDir/$fn\\\" ]; then\\n mkdir $out\\nfi\\nmv \\\"$unpackDir/$fn\\\" \\\"$out\\\"\\n\\n\\nchmod 755 \\\"$out\\\"\\n\",\"preferHashedMirrors\":false,\"preferLocalBuild\":true,\"propagatedBuildInputs\":[],\"propagatedNativeBuildInputs\":[],\"recursiveHash\":true,\"repo\":\"sys\",\"rev\":\"main\",\"revCustom\":\"main\",\"showURLs\":false,\"stdenv\":\"/nix/store/s2grcjv8pklvkajk3mkh75aja5dppx6z-stdenv-linux\",\"strictDeps\":false,\"stripRoot\":true,\"system\":\"x86_64-linux\",\"urls\":[\"https://github.com/keysmashes/sys/archive/main.tar.gz\"]}", ``` Applying the following nixpkgs patch to (badly) revert the __structuredAttrs addition gets the URL-guessing working again: ```patch diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh index 228fcd2ed1..26c76fa447 100644 --- a/pkgs/build-support/fetchurl/builder.sh +++ b/pkgs/build-support/fetchurl/builder.sh @@ -1,4 +1,3 @@ -source "$NIX_ATTRS_SH_FILE" source $mirrorsFile # Normalize `curlOpts` as a string. @@ -42,7 +41,6 @@ fi curl+=( - "${curlOptsList[@]}" $curlOpts $NIX_CURL_FLAGS ) diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix index ddd3075633..db22fe939e 100644 --- a/pkgs/build-support/fetchurl/default.nix +++ b/pkgs/build-support/fetchurl/default.nix @@ -169,7 +169,6 @@ # Passthru information, if any. passthru ? { }, - # Doing the download on a remote machine just duplicates network # traffic, so don't do that by default preferLocalBuild ? true, @@ -262,8 +261,6 @@ derivationArgs // { - __structuredAttrs = true; - name = if finalAttrs.pname or null != null && finalAttrs.version or null != null then "${finalAttrs.pname}-${finalAttrs.version}" @@ -339,8 +336,9 @@ '' ) curlOpts; + curlOptsList = lib.escapeShellArgs curlOptsList; + inherit - curlOptsList downloadToTemp executable mirrorsFile ```

sersorrel added the

bug

label

2026-04-03 20:39:32 +00:00

winter self-assigned this

2026-04-03 22:22:15 +00:00

lix-bot commented

2026-04-04 00:07:50 +00:00

Member

This issue was mentioned on Gerrit on the following CLs:

commit message in cl/5441 ("libstore/build: fix URL guesswork for failing structuredAttrs FODs")

This issue was mentioned on Gerrit on the following CLs: * commit message in [cl/5441](https://gerrit.lix.systems/c/lix/+/5441) ("libstore/build: fix URL guesswork for failing structuredAttrs FODs")

winter removed their assignment

2026-04-04 00:21:47 +00:00