lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(dirty-content-fingerprint): Nix flake computes fingerprint via self.narHash

Browse source 
Adds myDirtyFingerprint to flake.nix's existing eval-time let block,
computed as builtins.hashString "sha256" self.narHash truncated to 8 hex
chars (self.narHash is SRI base64, not hex -- rehashing is necessary),
gated on the same clean/dirty branch myCommitId already uses. No
preConfigure build-phase hook needed -- self.narHash has no pure-eval trap
unlike build_time's builtins.currentTime. Threaded through
nixSupport/default.nix into xce.nix/xcecli.nix's eval-time mesonFlags as
-Ddirty_fingerprint=, alongside the completely untouched -Dcommit_id=/
myCommitId and build_time's separate preConfigure mechanism.

Verified independently by review with real nix build/nix log inspection
on both xcecore_debug and xcecli: real, non-empty, content-sensitive
values reach mesonConfigurePhase, cross-checked deterministic via an
independent Python recomputation, with commit_id fully unaffected. Full
artifact completion is blocked by a pre-existing, unrelated sandbox
network limitation (confirmed recurring on two disjoint Go module sets),
not caused by this change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Rongsong Shen 2026-08-21 04:57:56 +00:00
parent c9d40ba180
commit fc5cba15e1
No known key found for this signature in database
GPG key ID: 5BCDAAE0123E9FE2
5 changed files with 48 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

29
src/flake.nix
View file

@ -29,6 +29,33 @@
# `preConfigure`, via stdenv's bundled `date -u`) -- see those files.
# Nothing build-time-related needs to be threaded through the flake
# or nixSupport/default.nix any more; only myCommitId still does.
# dirty-content-fingerprint task 2.2: myDirtyFingerprint is a new,
# independent eval-time value alongside myCommitId (myCommitId's own
# computation above, including its self.dirtyShortRev-derived -dirty
# suffix, is NOT touched by this addition). Unlike build_time
# (builtins.currentTime, stripped under pure-eval -- see the note
# above), self.narHash is a genuine flake self-introspection field
# with no pure-eval trap: it is reachable and content-sensitive with
# no --impure needed (empirically re-confirmed live: editing a
# tracked file changes it, reverting reproduces the original value
# exactly). self.narHash's own string form is SRI-style base64
# ("sha256-<base64>="), not hex, so it is rehashed via
# builtins.hashString "sha256" (which DOES return a base16/hex
# digest) and truncated to 8 hex chars to match the dev-loop path's
# format (xce-build.sh task 2.1's `sha256sum | cut -c1-8`). Resolves
# to empty on a clean tree, mirroring myCommitId's own
# hasAttr "shortRev" branch immediately above (a clean tree only has
# self.shortRev; a dirty tree also has self.dirtyShortRev).
# KNOWN, ACCEPTED LIMITATION (see research.md "Nix path accepts the
# untracked-file blind spot"): self.narHash does not reflect
# brand-new untracked files unless they are git-add-staged first --
# deliberately not engineered around here (would require adding git
# as a nix sandbox dependency, an explicit prior architectural
# decision this feature does not revisit).
myDirtyFingerprint =
if builtins.hasAttr "shortRev" self
then ""
else builtins.substring 0 8 (builtins.hashString "sha256" self.narHash);
in
flake-utils.lib.eachSystem supportedSystems (
system: let
@ -38,7 +65,7 @@
];
pkgs = import nixpkgs { inherit overlays system;};
xpkgs = import ./nixSupport/default.nix {
inherit pkgs myCommitId;
inherit pkgs myCommitId myDirtyFingerprint;
};
appImageScriptContent = builtins.readFile ./tools/appimage/entry.sh;
appImageEntryPackage = pkgs.writeShellApplication {