From debbugs-submit-bounces@debbugs.gnu.org Sun Oct 16 06:04:52 2022 Received: (at 58561) by debbugs.gnu.org; 16 Oct 2022 10:04:52 +0000 Received: from localhost ([127.0.0.1]:43450 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ok0Vo-0003xd-IS for submit@debbugs.gnu.org; Sun, 16 Oct 2022 06:04:52 -0400 Received: from tobias.gr ([80.241.217.52]:52098) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ok0Vn-0003xV-3x for 58561@debbugs.gnu.org; Sun, 16 Oct 2022 06:04:51 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=2018; bh=DthG5qdmTbwtY w1pi/0VLG48J7kEwWXYXqTKfPPztgU=; h=in-reply-to:date:subject:cc:to: from:references; d=tobias.gr; b=OPNOPJRV2wxON/aMjp6Dnh2eo/QphPuP0szPBr wISn5MoM8DnastvTcKajFsk8W3tSE7efKTOJaWifjPaZsgLbcR72Q3pY6UAbCk8hIiaGGK IL3hsPmp0Up+keCyZRDWhZCmk8Mme++nipkr5DZpK6ZD5emd3/gMpHNzboIVa5mzz9qXQa sgKi6uNQ2VPg/wDfm76G+6S5YFmjvrPYROT/e6c7eM8hQHothhIt4YdbcvtFRDET7/m49r 0aRFBWwzzOBeLzgErG3FZDTlL+GmsBnyU3ne0OFWbqxE1EuqSkA9YzFP7bo3POahB/7X40 R3dyJPh5wgtl/jYeiiltJAWA== Received: by submission.tobias.gr (OpenSMTPD) with ESMTPSA id e77b18a0 (TLSv1.3:AEAD-AES256-GCM-SHA384:256:NO); Sun, 16 Oct 2022 10:04:42 +0000 (UTC) References: <0df50579-d645-5a43-d558-4c49e503bb57@brendan.scot> From: Tobias Geerinckx-Rice To: mail@brendan.scot Subject: Re: bug#58561: Source hash mismatch with aggregator + possible guix bug with hashes. Date: Sun, 16 Oct 2022 11:45:00 +0200 In-reply-to: <0df50579-d645-5a43-d558-4c49e503bb57@brendan.scot> BIMI-Selector: v=BIMI1; s=default; Message-ID: <87y1tgulqk.fsf@nckx> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 58561 Cc: bug-guix@gnu.org, 58561@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --=-=-= Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable Hi Brendan, Oh! This is a fun one! Brendan Tildesley =E5=86=99=E9=81=93=EF=BC=9A > However what concerned me more is that when I look in the source=20 > code > it looks like this: > > (sha256 > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (base32=20 > "9yy5c29zxpli4cddknmdvjkgii3j7pvw6lhwqfrqjc8jh83gm8f8")) > > > Notice how at the start its a '9', not a '1'? [=E2=80=A6] > Is there a bug with how guix is reading/writing sha256 hashes? It's=E2=80=A6 not a bug. It's the opposite, kind of, although maybe=20 (probably) Guix could (should) reject clearly bogus input like=20 this. What's happening is this: In what can be described only as a bizarre coincidence, sha256=20 produces hashes that are 256 bits long. Base32=C2=B9 encodes 5 bits per character. Our =E2=80=98hash=E2=80=99 stri= ngs are=20 currently 52 characters long, meaning they encode 260 bits. If you poke around Guix, you'll notice that every valid base32=20 =E2=80=98sha256=E2=80=99 hash starts with a 0 or a 1, because those 4 leftm= ost=20 bits are never used, and hence set to zero. In the case of this "9=E2=80=A6" =E2=80=98hash=E2=80=99 (which was random d= ata, I guess?),=20 Guix still reads only 256 bits of the 260, and ignores those 4=20 =E2=80=98extra=E2=80=99 leftmost bits. When it later prints the hash, it converts those 256 bits back to=20 base32, now padded with zeroes, and you see a =E2=80=98hash=E2=80=99 starti= ng with=20 1. What Guix could do is refuse to continue when it detects set=20 higher bits, as they always indicate programmer error. Kind regards, T G-R 1: Guix uses =E2=80=98nix-base32=E2=80=99 which uses a slightly different a= lphabet=20 from the more common base32 variant, but is otherwise identical in=20 operation. --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iIMEARYKACsWIQT12iAyS4c9C3o4dnINsP+IT1VteQUCY0vXcw0cbWVAdG9iaWFz LmdyAAoJEA2w/4hPVW15c10BAO5xfaxF596dkXKYFwiyK69C6UJNNSt5BU7cQSkY E7T8AQCRXN+NGyaaE5UuIrJsVusUp22uf0rny4EtIYp8Kpx7Cw== =A3ki -----END PGP SIGNATURE----- --=-=-=--