From b55c7af097e5ab8c3edbd6798fac0fac22887ee1 Mon Sep 17 00:00:00 2001 From: hermes-agent Date: Mon, 2 Nov 2026 10:13:46 +0100 Subject: [PATCH] romm-mcp: pin the real source and npmDeps hashes Both come from the build, and both were non-obvious: - fetchzip hashes the *unpacked* tree, not the .tgz bytes, so a hash computed from the published tarball does not match; the derivation reports the NAR hash of the extracted contents instead. - npmDepsHash only exists once npm has materialised the dependency tree from the committed lockfile. Verified with nix build .#romm-mcp: the derivation builds and ./result/bin/romm-mcp starts and prints 'RomM MCP server running on stdio'. --- packages/romm-mcp/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/romm-mcp/package.nix b/packages/romm-mcp/package.nix index 9e067c0..76b5ca4 100644 --- a/packages/romm-mcp/package.nix +++ b/packages/romm-mcp/package.nix @@ -10,7 +10,7 @@ buildNpmPackage rec { src = fetchzip { url = "https://registry.npmjs.org/${pname}/-/${pname}-${version}.tgz"; - hash = "sha256-Cg4Pa2jxwmMyuc2LyFJA1uNjFgaLaPgMXyvpY2HrPFM="; + hash = "sha256-SOYzG0CtNSvIrxOYJq3UDXRlXylqbDjo2f5qfpbiYmI="; }; # Upstream publishes no package-lock.json (only package.json), and @@ -18,7 +18,7 @@ buildNpmPackage rec { # from the published tarball itself -- `npm install --package-lock-only # --ignore-scripts` inside the extracted 1.0.5 package -- so it locks exactly # the dependency tree that shipped with this version. - npmDepsHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="; + npmDepsHash = "sha256-oSlECdIf2ZP8ZZhOUChkcJAmUTj6TFTdeTJLY5RwLGo="; postPatch = '' cp ${./package-lock.json} package-lock.json