Duplicate hashes in build.zig.zon

[raddari]

Zig Version

0.12.0-dev.278+0e8f130ae

Steps to Reproduce and Observed Behavior

With the following build.zig.zon, I add the zgl dependency:

.{
    .name = "project",
    .version = "0.1.0",
    .dependencies = .{
        .zgl = .{
            .url = "https://github.com/ziglibs/zgl/archive/81d6990d2849ffd2d082f6ae364a03cc0162ba7e.tar.gz",
        },
    },
}

Running zig build leads to the hash being generated, as expected:

Fetch Packages... zgl... <project dir>/build.zig.zon:6:20: error: url field is missing corresponding hash field
            .url = "https://github.com/ziglibs/zgl/archive/81d6990d2849ffd2d082f6ae364a03cc0162ba7e.tar.gz",
                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
note: expected .hash = "12203782cb2501aa5fa88ce6ae488bcbdc86bf7cb002b641262bb0d897b1240aab50",

So I add this to build.zig.zon, and zig build is successful.

Now I want to add zlm, so I repeat the steps above:

.{
    .name = "project",
    .version = "0.1.0",
    .dependencies = .{
        .zgl = .{
            .url = "https://github.com/ziglibs/zgl/archive/81d6990d2849ffd2d082f6ae364a03cc0162ba7e.tar.gz",
            .hash = "12203782cb2501aa5fa88ce6ae488bcbdc86bf7cb002b641262bb0d897b1240aab50",
        },
        .zlm = .{
            .url = "https://github.com/ziglibs/zlm/archive/dce0e8ead4b14b2105076fad9cbc43bbdf439c21.tar.gz",
        },
    },
}

Fetch Packages [2/1] zlm... <project dir>/build.zig.zon:10:20: error: url field is missing corresponding hash field
            .url = "https://github.com/ziglibs/zlm/archive/dce0e8ead4b14b2105076fad9cbc43bbdf439c21.tar.gz",
                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
note: expected .hash = "12203782cb2501aa5fa88ce6ae488bcbdc86bf7cb002b641262bb0d897b1240aab50",

Something seems wrong; the expected hash is the same for both zgl and zlm. If I add this to the build.zig.zon, the build still succeeds.

.{
    .name = "project",
    .version = "0.1.0",
    .dependencies = .{
        .zgl = .{
            .url = "https://github.com/ziglibs/zgl/archive/81d6990d2849ffd2d082f6ae364a03cc0162ba7e.tar.gz",
            .hash = "12203782cb2501aa5fa88ce6ae488bcbdc86bf7cb002b641262bb0d897b1240aab50",
        },
        .zlm = .{
            .url = "https://github.com/ziglibs/zlm/archive/dce0e8ead4b14b2105076fad9cbc43bbdf439c21.tar.gz",
            .hash = "12203782cb2501aa5fa88ce6ae488bcbdc86bf7cb002b641262bb0d897b1240aab50",
        },
    },
}

Inspecting the global cache shows that only one of the packages was downloaded, in this case zgl:

$ ls "$XDG_CACHE_HOME/zig/p"
12203782cb2501aa5fa88ce6ae488bcbdc86bf7cb002b641262bb0d897b1240aab50/

$ ls "$XDG_CACHE_HOME/zig/p/12203782cb2501aa5fa88ce6ae488bcbdc86bf7cb002b641262bb0d897b1240aab50"
binding.zig  build.zig  gyro.zzz  LICENSE  README.md  types.zig  zgl.zig

As such I am unable to depend on both zgl and zlm with the package manager, and have to fall back to using git submodules. I have tried clearing the local and global caches, adding the dependencies and building the zig project in every possible combination, adding the dependencies separately to two unique projects, but this problem persists.

Expected Behavior

zgl and zlm are hashed separately and can both be added as a dependency to the same project.

I can add other packages from git in the build.zig.zon just fine, it seems to be only these two packages with a duplicate hash.

[raddari]

#16679 seems kind of related, except in that case the correct hash is reported when the duplicate hash is deleted from build.zig.zon.

[p7r0x7]

Why do all the hashes zig generates begin with 0x1220?

[raddari]

Why do all the hashes zig generates begin with 0x1220?

From what I recall, zig uses the multihash protocol - 0x12 means the hash is SHA2-256, and 0x20 means it is 32 bytes long.

I haven’t looked too deep into zig std to find where it calculates the hash for package dependencies, but I’m sure the answer to this issue is in there somewhere.

[raddari]

Looks like a derivate of #17095 - I'll close this.