사용 방법
- 설치 명령을 복사하고 자신의 에이전트 환경에 설치하기 전에 소스 패키지를 확인하세요.
- 필요한 도구, 인증 정보, 지원 환경은 원본 문서에서 확인하세요.
- 입력과 원하는 산출물을 설명하고 출처와 결과를 대조하세요.
npx skills add https://github.com/atvari-eu/nix-skills --skill nix-hash시작 전 확인
- 설치에는 모델 구독, API 한도, 파일 접근 권한이 포함되지 않습니다.
- 별점 수와 설치 수는 활동 지표이며 독립적인 품질·보안 검증이 아닙니다.
원본 저장소의 제목, 예시, 코드, 표, 링크, 이미지를 유지해 표시합니다.
Nix Hash
Hash Formats in Nix
Nix uses several hash encodings:
- SRI (
sha256-BASE64) — The modern standard, used infetchFromGitHub,fetchurl, etc. Format:<algo>-<base64> - Hex / base16 (
84a5d14c...) — The encoding most upstream projects publish - Base32 (
020ay2q1...) — Nix-specific legacy encoding; still printed by default bynix-prefetch-url
SRI is the preferred format. Always use SRI hashes in new derivations.
Flat vs NAR Hashes
Which bytes get hashed depends on how the fetcher consumes the source:
- Raw file bytes ("flat") — matches plain
fetchurl(nounpack = true). Compute withnix hash file. - NAR serialisation of an unpacked tree — matches
fetchFromGitHub,fetchzip, and any fetcher withunpack = true. Compute withnix hash path.
Prefetch accordingly: without unpacking for plain fetchurl, with unpacking when the fetcher extracts the archive. Getting this wrong is the most common cause of hash mismatches.
Common Commands
Converting Hashes
# Convert any hash to SRI (hex/base32 input auto-detected)
nix hash to-sri --type sha256 <hash>
# Convert SRI to hex
nix hash to-base16 --type sha256 <sri-hash>On upstream Nix ≥ 2.19 these conversions also exist as nix hash convert --to sri|base16|base32 --hash-algo sha256 <hash>. Lix does not provide nix hash convert.
Computing Hashes
# Raw bytes of a file (matches plain fetchurl); add --base16 for hex output
nix hash file --type sha256 --sri <file>
# NAR serialisation of a tree (matches fetchFromGitHub/fetchzip)
nix hash path --type sha256 --sri <dir>
# Hash a string
nix hash to-sri --type sha256 $(echo -n "my-string" | sha256sum | cut -d' ' -f1)Prefetching (for fetchFromGitHub, fetchurl, etc.)
# GitHub repo at tag/branch; JSON includes resolved rev and SRI hash
nix flake prefetch 'github:<owner>/<repo>?ref=<ref>'
# Raw file (plain fetchurl); JSON includes SRI hash
nix store prefetch-file --json <url>
# Unpacked archive (fetchzip / unpack = true); JSON includes SRI hash
nix store prefetch-file --json --unpack <url>
# Legacy alternative: prints base32 — convert with `nix hash to-sri`
nix-prefetch-url [--unpack] [--type sha256] <url>nix-prefetch-github is a third-party tool and not always installed; prefer the built-in commands above.
Using Hashes in Derivations
Fetchers take hash in SRI form; default to sha256 unless upstream only publishes another algorithm:
pkgs.fetchFromGitHub {
owner = "owner";
repo = "repo";
rev = "v1.0.0";
hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
}pkgs.fetchurl and pkgs.fetchpatch follow the same pattern (url + hash).
When Hashes Don't Match
A hash mismatch means either the stored hash is wrong or the source changed unexpectedly. To get the correct hash, temporarily set hash = lib.fakeHash;, rebuild, and copy the got: value from the error:
error: hash mismatch in fixed-output derivation
specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
got: sha256-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=When updating a package, verify that the changed hash is expected: check the upstream diff between the old and new rev instead of blindly accepting a new hash, since a surprise change can also mean a compromised or retargeted source.
