grafana-10.1.0.linux-amd64.tar.gz: hash changed

[colemickens]

Describe the bug

error: hash mismatch in fixed-output derivation '/nix/store/0qbjg9nh33sizg96g9k92ylgqdvaf4xg-grafana-10.1.0.linux-amd64.tar.gz.drv':
         specified: sha256-lgCSJgFcrZb4ki4/YdVRgXvVBjQrmEoTPf/KficA3sM=
            got:    sha256-QFRahjDyL7BNikK2cCsFLfu4/odDbkCxplf6f7yCezE=

from the nixpkgs I was using:

  srcStatic = fetchurl {
    url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
    hash = "sha256-lgCSJgFcrZb4ki4/YdVRgXvVBjQrmEoTPf/KficA3sM=";
  };

https://dl.grafana.com/oss/release/grafana-10.1.0.linux-amd64.tar.gz

Checking on another machine:

╭ zeph  ~/code/nixcfg 12sec 297ms ✘-1
╰─▶ nix-prefetch-url 'https://dl.grafana.com/oss/release/grafana-10.1.0.linux-amd64.tar.gz'
path is '/nix/store/qqj225x5ps5nw1vchjqzgxy5yyj9qbsc-grafana-10.1.0.linux-amd64.tar.gz'
0cbvhay7zyjplsql0vj3hzzbiyrd0lmp1dj2i96v0bzj6235lm20

╭ zeph  ~/code/nixcfg 15ms ✘1
╰─▶ nix hash to-sri 'sha256:0cbvhay7zyjplsql0vj3hzzbiyrd0lmp1dj2i96v0bzj6235lm20'
sha256-QFRahjDyL7BNikK2cCsFLfu4/odDbkCxplf6f7yCezE=

This seems odd, wanted to call it out in case there's a more concerning issue at hand.

[importantblimp]

It looks like this has been fixed on master under #251479

[pinpox]

Temporary workaround until the fix is merged:

    services.grafana = {
      package = (pkgs.grafana.override {
        buildGoModule = args: pkgs.buildGoModule (args // {
          srcStatic = pkgs.fetchurl {
            url = "https://dl.grafana.com/oss/release/grafana-10.1.0.linux-amd64.tar.gz";
            hash = "sha256-QFRahjDyL7BNikK2cCsFLfu4/odDbkCxplf6f7yCezE=";
          };
        });
      });

[kminehart]

Sorry about this! Grafana's whole process for packaging and releasing has sort of grown into this amalgamous thing that has changed hands quite a lot over the years. In our effort to replace it with something more reproducible, we had to make a few hotfixes and re-deploy the 10.1.0 release a few times.

I don't think any of us knew that there was an expectation that the tar.gz packages we distribute wouldn't change, but it totally makes sense. My apologies about the inconvenience this caused; now that we know, we'll be more careful in the future not to overwrite previously released tarballs (or if we have to, we'll be sure to reach out beforehand).

If there's an interest in producing this tarball from source, we've made it a lot easier using https://github.com/grafana/grafana-build.

Thanks!

[RichiH]

@kminehart We could also use suffices which SemVer considers void to have a different tarball name. 10.1.0.1 would also be an option.

While SemVer deliberately does not support subpatches Grafana's build system supports them.