gastownhall/beads · error

could not parse correct hash from nix output: %s

Error message

could not parse correct hash from nix output:
%s

What it means

After writing the sentinel hash and running `nix build`, fixNixHash scans the build output for Nix's 'got:' hash line to learn the correct vendorHash. If no hash can be extracted from the nix output (m == nil), it cannot determine the right value and returns this error including the raw nix output for diagnosis.

Source

Thrown at cmd/bd/preflight.go:804

	nixCmd := exec.CommandContext(ctx, "nix", "build", ".#default", "--no-link")
	nixOut, _ := nixCmd.CombinedOutput()

	// Nix prints the correct hash in lines like "got:    sha256-..."
	hashRe := regexp.MustCompile(`got:\s+(sha256-[A-Za-z0-9+/]+=)`)
	m := hashRe.FindSubmatch(nixOut)
	if m == nil {
		// Fallback: pick any sha256-... that isn't our sentinel
		altRe := regexp.MustCompile(`sha256-([A-Za-z0-9+/]+=)`)
		for _, am := range altRe.FindAllSubmatch(nixOut, -1) {
			h := "sha256-" + string(am[1])
			if h != sentinel {
				m = [][]byte{nil, []byte(h)}
				break
			}
		}
	}
	if m == nil {
		return false, oldHash, "", fmt.Errorf("could not parse correct hash from nix output:\n%s", string(nixOut))
	}
	newHash := string(m[1])

	if newHash == oldHash {
		_ = os.WriteFile(nixPath, content, nixPerm)
		restored = true
		return false, oldHash, newHash, nil
	}

	updated := append(append([]byte{}, content[:loc[4]]...), append([]byte(newHash), content[loc[5]:]...)...)
	if err := os.WriteFile(nixPath, updated, nixPerm); err != nil {
		return false, oldHash, newHash, fmt.Errorf("cannot update default.nix: %v", err)
	}
	restored = true
	return true, oldHash, newHash, nil
}

// fixVersionSync updates cmd/bd/version.go to match the version in default.nix.

View on GitHub (pinned to 71377f2769)

Solutions

1. Read the nix output embedded in the error and fix the actual build failure it reports, then re-run `bd fix`
2. Manually obtain the hash: set `vendorHash = ""` in default.nix (or use lib.fakeSha256), run `nix build .#default`, and copy the 'got:' value from the error into vendorHash
3. Run `nix build .#default 2>&1 | grep -i got:` yourself to see the full untruncated output
4. Update locks/fetchers if the failure is network-related (nix with proper sandbox flags or a mirror)

Example fix

// before
could not parse correct hash from nix output:
error: ... attribute 'goModules' missing
// after (fix the nix file error first, then)
bd fix  # now parses 'got: sha256-...' successfully

// sanity: run nix build first and confirm the got: line appears
nix build .#default 2>&1 | tee /tmp/nix.log && grep -i 'got:' /tmp/nix.log

out, err := exec.Command("bd", "fix").CombinedOutput()
if err != nil && strings.Contains(string(out), "could not parse correct hash from nix output") {
    // inspect the embedded nix output in the error and fix the real build failure
}

When it happens

Trigger: The regex scan over nix build output finds no 'got:' hash — e.g. `nix build` failed for an unrelated reason (syntax error in default.nix, missing go.mod deps, network failure fetching the store), nix printed an error in an unexpected format, or the output was empty because Output() captured nothing on failure path not using CombinedOutput.

Common situations: Nix build breaks on something other than the hash mismatch (so the 'got:' line never appears); Nix version output format changed; sandbox/network errors prevent the build from reaching hash verification; stale flake lock.

Related errors

• vendorHash not found in default.nix
• dolt version output is unparseable
• parsing batch input: %w
• line %d: %w
• line %d: 'dep' requires a subcommand (add|remove)

AI-assisted analysis of gastownhall/beads@71377f2769 (2026-08-30). Data as JSON: /api/errors/4b97c9f575d02319. Report an issue: GitHub.