Conversation
…es in hashes Add Normalize() method to nar.URL to handle NAR URLs with embedded narinfo hash prefixes. Some upstream caches (like nix-serve) serve NAR URLs with the narinfo hash as a prefix (e.g., "narinfo-hash-actual-hash"). This method strips the prefix by identifying the first separator (dash or underscore) and removing everything before it. Changes: - pkg/nar/url.go: Add Normalize() method and supporting logic - pkg/nar/hash.go: Update narHashPattern to allow dashes and underscores ([a-z0-9_-]+) - pkg/nar/url_test.go: Add TestNormalize with three test cases (no prefix, dash-separated, underscore-separated) - testdata/nar7.go: Update to use prefixed hash format for testing This enables parsing and normalizing NAR URLs from sources that include hash prefixes, which will be applied consistently across cache, storage, and test layers in subsequent commits. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Summary of ChangesHello @kalbasit, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces functionality to robustly handle NAR URLs that may contain an informational hash prefix, as seen in some upstream caches like Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
There was a problem hiding this comment.
Code Review
This pull request introduces a Normalize() function to handle NAR URLs with prefixes and updates the NAR hash pattern to allow dashes and underscores. While the feature is useful, the implementation of the Normalize function has a critical flaw. Its logic is complex and uses a weak heuristic that can incorrectly modify valid NAR hashes that happen to contain a separator. This could lead to data corruption or invalid hash errors downstream. I've provided a much simpler and more robust implementation that uses a stronger heuristic based on the known length of narinfo hashes. Additionally, the accompanying tests are not comprehensive enough to catch these issues, so I've recommended adding more test cases for edge scenarios.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #836 +/- ##
=======================================
Coverage 85.41% 85.41%
=======================================
Files 2 2
Lines 480 480
=======================================
Hits 410 410
Misses 65 65
Partials 5 5 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
- Implement 32-character prefix heuristic for identifying narinfo hash prefixes. - Sanitize the hash using filepath.Clean and check for path traversal sequences. - Add comprehensive test cases for edge cases and path traversal attempts. This addresses critical security and logic issues identified in PR comments.
|
Backport failed for Please cherry-pick the changes locally and resolve any conflicts. git fetch origin release-0.8
git worktree add -d .worktree/backport-836-to-release-0.8 origin/release-0.8
cd .worktree/backport-836-to-release-0.8
git switch --create backport-836-to-release-0.8
git cherry-pick -x 20012d5c911eda931990e2076e37c4c6bc2d5be2 c2924c9a11dc9c9b792460f6f1da3eb16524d5b9 |
…es in hashes [backport #836] Add Normalize() method to nar.URL to handle NAR URLs with embedded narinfo hash prefixes. Some upstream caches (like nix-serve) serve NAR URLs with the narinfo hash as a prefix (e.g., "narinfo-hash-actual-hash"). This method strips the prefix by identifying the first separator (dash or underscore) and removing everything before it. Changes: - pkg/nar/url.go: Add Normalize() method and supporting logic - pkg/nar/hash.go: Update narHashPattern to allow dashes and underscores ([a-z0-9_-]+) - pkg/nar/url_test.go: Add TestNormalize with three test cases (no prefix, dash-separated, underscore-separated) - testdata/nar7.go: Update to use prefixed hash format for testing This enables parsing and normalizing NAR URLs from sources that include hash prefixes, which will be applied consistently across cache, storage, and test layers in subsequent commits. Part of #806 Closes #820 Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> (cherry picked from commit 7e1c28e)
…es in hashes [backport #836] Add Normalize() method to nar.URL to handle NAR URLs with embedded narinfo hash prefixes. Some upstream caches (like nix-serve) serve NAR URLs with the narinfo hash as a prefix (e.g., "narinfo-hash-actual-hash"). This method strips the prefix by identifying the first separator (dash or underscore) and removing everything before it. Changes: - pkg/nar/url.go: Add Normalize() method and supporting logic - pkg/nar/hash.go: Update narHashPattern to allow dashes and underscores ([a-z0-9_-]+) - pkg/nar/url_test.go: Add TestNormalize with three test cases (no prefix, dash-separated, underscore-separated) - testdata/nar7.go: Update to use prefixed hash format for testing This enables parsing and normalizing NAR URLs from sources that include hash prefixes, which will be applied consistently across cache, storage, and test layers in subsequent commits. Part of #806 Closes #820 Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> (cherry picked from commit 7e1c28e)

Add Normalize() method to nar.URL to handle NAR URLs with embedded narinfo hash
prefixes. Some upstream caches (like nix-serve) serve NAR URLs with the narinfo
hash as a prefix (e.g., "narinfo-hash-actual-hash"). This method strips the prefix
by identifying the first separator (dash or underscore) and removing everything
before it.
Changes:
This enables parsing and normalizing NAR URLs from sources that include hash
prefixes, which will be applied consistently across cache, storage, and test
layers in subsequent commits.
Part of #806
Closes #820
Co-Authored-By: Claude Haiku 4.5 noreply@anthropic.com