Abusing SHA-1 collisions for Chromium updates
If I'm understanding this glorious hack correctly, this allows Nix to determine if Chrome has an update available:<p>1) Nix network access is only allowed for things where you guarantee the hashes of what's output. This is generally used to do things like "download <a href="http://example.com/release-1.2.tar.xz" rel="nofollow">http://example.com/release-1.2.tar.xz</a>, it will have SHA1 93f3025c7802a1a11e4f16186089b583ef1095b8"<p>2) There are known pairs of strings that have equivalent SHA1 hashes.<p>3) To determine if a fetch would succeed in a "pure" way, write a network-accessing function that will return a "true" or "false" string with identical hashes, then you can use that (supposedly deterministic) string to return a (nondeterministic!) True or False to the caller.<p>4) This is used to run a command like `curl -s -L -f -I  <a href="https://commondatastorage.googleapis.com/chromium-browser-official/chromium-74.0.3729.169.tar.xz" rel="nofollow">https://commondatastorage.googleapis.com/chromium-browser-of...</a> `. If the command succeeds, we know we can use this version of the browser to update.<p>I don't know how it reads the channel version data without running into the same determinism issues.<p>Here's the latest update to the hack, moving from MD5 to SHA1: <a href="https://github.com/NixOS/nixpkgs/commit/ed8f3b5fa3cebfc3662ad5fff098567616220cf8" rel="nofollow">https://github.com/NixOS/nixpkgs/commit/ed8f3b5fa3cebfc3662a...</a>