From bfe4cdf88ee3e88910d22291a4c745462f2d6417 Mon Sep 17 00:00:00 2001
From: Ludovic Courtès <ludo@gnu.org>
Date: Thu, 3 Dec 2020 09:44:22 +0100
Subject: daemon: Raise an error if substituter doesn't send the expected hash.

It was already impossible in practice for 'expectedHashStr' to be empty
if 'status' == "success".

* nix/libstore/build.cc (SubstitutionGoal::finished): Throw 'SubstError'
when 'expectedHashStr' is empty.
---
 nix/libstore/build.cc | 37 +++++++++++++++++++------------------
 1 file changed, 19 insertions(+), 18 deletions(-)

diff --git a/nix/libstore/build.cc b/nix/libstore/build.cc
index 6cfe7aba7e..b5551b87ae 100644
--- a/nix/libstore/build.cc
+++ b/nix/libstore/build.cc
@@ -3040,27 +3040,28 @@ void SubstitutionGoal::finished()
         if (!pathExists(destPath))
             throw SubstError(format("substitute did not produce path `%1%'") % destPath);
 
+	if (expectedHashStr == "")
+	    throw SubstError(format("substituter did not communicate hash for `%1'") % storePath);
+
         hash = hashPath(htSHA256, destPath);
 
         /* Verify the expected hash we got from the substituer. */
-        if (expectedHashStr != "") {
-            size_t n = expectedHashStr.find(':');
-            if (n == string::npos)
-                throw Error(format("bad hash from substituter: %1%") % expectedHashStr);
-            HashType hashType = parseHashType(string(expectedHashStr, 0, n));
-            if (hashType == htUnknown)
-                throw Error(format("unknown hash algorithm in `%1%'") % expectedHashStr);
-            Hash expectedHash = parseHash16or32(hashType, string(expectedHashStr, n + 1));
-            Hash actualHash = hashType == htSHA256 ? hash.first : hashPath(hashType, destPath).first;
-            if (expectedHash != actualHash) {
-		if (settings.printBuildTrace)
-		    printMsg(lvlError, format("@ hash-mismatch %1% %2% %3% %4%")
-			     % storePath % "sha256"
-			     % printHash16or32(expectedHash)
-			     % printHash16or32(actualHash));
-                throw SubstError(format("hash mismatch for substituted item `%1%'") % storePath);
-	    }
-        }
+	size_t n = expectedHashStr.find(':');
+	if (n == string::npos)
+	    throw Error(format("bad hash from substituter: %1%") % expectedHashStr);
+	HashType hashType = parseHashType(string(expectedHashStr, 0, n));
+	if (hashType == htUnknown)
+	    throw Error(format("unknown hash algorithm in `%1%'") % expectedHashStr);
+	Hash expectedHash = parseHash16or32(hashType, string(expectedHashStr, n + 1));
+	Hash actualHash = hashType == htSHA256 ? hash.first : hashPath(hashType, destPath).first;
+	if (expectedHash != actualHash) {
+	    if (settings.printBuildTrace)
+		printMsg(lvlError, format("@ hash-mismatch %1% %2% %3% %4%")
+			 % storePath % "sha256"
+			 % printHash16or32(expectedHash)
+			 % printHash16or32(actualHash));
+	    throw SubstError(format("hash mismatch for substituted item `%1%'") % storePath);
+	}
 
     } catch (SubstError & e) {
 
-- 
cgit 1.4.1