Abusing SHA-1 collisions for Chromium updates
If I'm understanding this glorious hack correctly, this allows Nix to determine if Chrome has an update available:1) Nix network access is only allowed for things where you guarantee the hashes of what's output. This is generally used to do things like "download http://example.com/release-1.2.tar.xz, it will have SHA1 93f3025c7802a1a11e4f16186089b583ef1095b8"2) There are known pairs of strings that have equivalent SHA1 hashes.3) To determine if a fetch would succeed in a "pure" way, write a network-accessing function that will return a "true" or "false" string with identical hashes, then you can use that (supposedly deterministic) string to return a (nondeterministic!) True or False to the caller.4) This is used to run a command like `curl -s -L -f -I  https://commondatastorage.googleapis.com/chromium-browser-of... `. If the command succeeds, we know we can use this version of the browser to update.I don't know how it reads the channel version data without running into the same determinism issues.Here's the latest update to the hack, moving from MD5 to SHA1: https://github.com/NixOS/nixpkgs/commit/ed8f3b5fa3cebfc3662a...