fetch-*: remove md5 support

fixes #4491

8 files changed, 44 insertions, 24 deletions

diff --git a/pkgs/build-support/fetchdarcs/default.nix b/pkgs/build-support/fetchdarcs/default.nix
index 3c2e0524eea..2644a20d0a5 100644
--- a/pkgs/build-support/fetchdarcs/default.nix
+++ b/pkgs/build-support/fetchdarcs/default.nix
@@ -1,13 +1,16 @@
 {stdenv, darcs, nix}: {url, rev ? null, context ? null, md5 ? "", sha256 ? ""}:
 
+if md5 != "" then
+  throw "fetchdarcs does not support md5 anymore, please use sha256"
+else
 stdenv.mkDerivation {
   name = "fetchdarcs";
   builder = ./builder.sh;
   buildInputs = [darcs];
 
-  outputHashAlgo = if sha256 == "" then "md5" else "sha256";
+  outputHashAlgo = "sha256";
   outputHashMode = "recursive";
-  outputHash = if sha256 == "" then md5 else sha256;
-  
+  outputHash = sha256;
+
   inherit url rev context;
 }
diff --git a/pkgs/build-support/fetchegg/default.nix b/pkgs/build-support/fetchegg/default.nix
index 3e0d5d566ad..41d2c936e01 100644
--- a/pkgs/build-support/fetchegg/default.nix
+++ b/pkgs/build-support/fetchegg/default.nix
@@ -4,14 +4,17 @@
 { stdenv, chicken }:
 { name, version, md5 ? "", sha256 ? "" }:
 
+if md5 != "" then
+  throw "fetchegg does not support md5 anymore, please use sha256"
+else
 stdenv.mkDerivation {
   name = "chicken-${name}-export";
   builder = ./builder.sh;
   buildInputs = [ chicken ];
 
-  outputHashAlgo = if sha256 == "" then "md5" else "sha256";
+  outputHashAlgo = "sha256";
   outputHashMode = "recursive";
-  outputHash = if sha256 == "" then md5 else sha256;
+  outputHash = sha256;
 
   inherit version;
 
diff --git a/pkgs/build-support/fetchgit/default.nix b/pkgs/build-support/fetchgit/default.nix
index e40b460d390..d85d2c893c5 100644
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@@ -39,18 +39,20 @@ in
    server admins start using the new version?
 */
 
-assert md5 != "" || sha256 != "";
 assert deepClone -> leaveDotGit;
 
+if md5 != "" then
+  throw "fetchgit does not support md5 anymore, please use sha256"
+else
 stdenv.mkDerivation {
   inherit name;
   builder = ./builder.sh;
   fetcher = "${./nix-prefetch-git}";  # This must be a string to ensure it's called with bash.
   buildInputs = [git];
 
-  outputHashAlgo = if sha256 == "" then "md5" else "sha256";
+  outputHashAlgo = "sha256";
   outputHashMode = "recursive";
-  outputHash = if sha256 == "" then md5 else sha256;
+  outputHash = sha256;
 
   inherit url rev leaveDotGit fetchSubmodules deepClone branchName;
 
diff --git a/pkgs/build-support/fetchhg/default.nix b/pkgs/build-support/fetchhg/default.nix
index 79f610166a7..aba12317963 100644
--- a/pkgs/build-support/fetchhg/default.nix
+++ b/pkgs/build-support/fetchhg/default.nix
@@ -1,5 +1,8 @@
 {stdenv, mercurial, nix}: {name ? null, url, rev ? null, md5 ? null, sha256 ? null, fetchSubrepos ? false}:
 
+if md5 != null then
+  throw "fetchhg does not support md5 anymore, please use sha256"
+else
 # TODO: statically check if mercurial as the https support if the url starts woth https.
 stdenv.mkDerivation {
   name = "hg-archive" + (if name != null then "-${name}" else "");
@@ -8,14 +11,11 @@ stdenv.mkDerivation {
 
   impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars;
 
-  # Nix <= 0.7 compatibility.
-  id = md5;
-
   subrepoClause = if fetchSubrepos then "S" else "";
 
-  outputHashAlgo = if md5 != null then "md5" else "sha256";
+  outputHashAlgo = "sha256";
   outputHashMode = "recursive";
-  outputHash = if md5 != null then md5 else sha256;
+  outputHash = sha256;
 
   inherit url rev;
   preferLocalBuild = true;
diff --git a/pkgs/build-support/fetchnuget/default.nix b/pkgs/build-support/fetchnuget/default.nix
index 95bb7b7cd8d..62b700dd81b 100644
--- a/pkgs/build-support/fetchnuget/default.nix
+++ b/pkgs/build-support/fetchnuget/default.nix
@@ -8,9 +8,12 @@ attrs @
 , md5 ? ""
 , ...
 }:
+if md5 != "" then
+  throw "fetchnuget does not support md5 anymore, please use sha256"
+else
   buildDotnetPackage ({
     src = fetchurl {
-      inherit url sha256 md5;
+      inherit url sha256;
       name = "${baseName}.${version}.zip";
     };
 
diff --git a/pkgs/build-support/fetchsvn/default.nix b/pkgs/build-support/fetchsvn/default.nix
index 747052c1cb7..6ed34ec0276 100644
--- a/pkgs/build-support/fetchsvn/default.nix
+++ b/pkgs/build-support/fetchsvn/default.nix
@@ -25,14 +25,17 @@ let
   name_ = if name == null then "${repoName}-r${toString rev}" else name;
 in
 
+if md5 != "" then
+  throw "fetchsvn does not support md5 anymore, please use sha256"
+else
 stdenv.mkDerivation {
   name = name_;
   builder = ./builder.sh;
   buildInputs = [subversion];
 
-  outputHashAlgo = if sha256 == "" then "md5" else "sha256";
+  outputHashAlgo = "sha256";
   outputHashMode = "recursive";
-  outputHash = if sha256 == "" then md5 else sha256;
+  outputHash = sha256;
 
   inherit url rev sshSupport openssh ignoreExternals ignoreKeywords;
 
diff --git a/pkgs/build-support/fetchsvnssh/default.nix b/pkgs/build-support/fetchsvnssh/default.nix
index 6c6c03d6873..a6f3d3469f0 100644
--- a/pkgs/build-support/fetchsvnssh/default.nix
+++ b/pkgs/build-support/fetchsvnssh/default.nix
@@ -1,16 +1,20 @@
 {stdenv, subversion, sshSupport ? false, openssh ? null, expect}: 
 {username, password, url, rev ? "HEAD", md5 ? "", sha256 ? ""}:
 
+
+if md5 != "" then
+  throw "fetchsvnssh does not support md5 anymore, please use sha256"
+else
 stdenv.mkDerivation {
   name = "svn-export-ssh";
   builder = ./builder.sh;
   buildInputs = [subversion expect];
 
-  outputHashAlgo = if sha256 == "" then "md5" else "sha256";
+  outputHashAlgo = "sha256";
   outputHashMode = "recursive";
-  outputHash = if sha256 == "" then md5 else sha256;
-  
+  outputHash = sha256;
+
   sshSubversion = ./sshsubversion.exp;
-  
+
   inherit username password url rev sshSupport openssh;
 }
diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index 00f485ce697..1e872fbc57a 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -87,12 +87,14 @@ assert sha512 != "" -> builtins.compareVersions "1.11" builtins.nixVersion <= 0;
 let
 
   hasHash = showURLs || (outputHash != "" && outputHashAlgo != "")
-    || md5 != "" || sha1 != "" || sha256 != "" || sha512 != "";
+    || sha1 != "" || sha256 != "" || sha512 != "";
   urls_ = if urls != [] then urls else [url];
 
 in
 
-if (!hasHash) then throw "Specify hash for fetchurl fixed-output derivation: ${stdenv.lib.concatStringsSep ", " urls_}" else stdenv.mkDerivation {
+if md5 != "" then throw "fetchsvnssh does not support md5 anymore, please use sha256 or sha512"
+else if (!hasHash) then throw "Specify hash for fetchurl fixed-output derivation: ${stdenv.lib.concatStringsSep ", " urls_}"
+else stdenv.mkDerivation {
   name =
     if showURLs then "urls"
     else if name != "" then name
@@ -110,9 +112,9 @@ if (!hasHash) then throw "Specify hash for fetchurl fixed-output derivation: ${s
 
   # New-style output content requirements.
   outputHashAlgo = if outputHashAlgo != "" then outputHashAlgo else
-      if sha512 != "" then "sha512" else if sha256 != "" then "sha256" else if sha1 != "" then "sha1" else "md5";
+      if sha512 != "" then "sha512" else if sha256 != "" then "sha256" else "sha1";
   outputHash = if outputHash != "" then outputHash else
-      if sha512 != "" then sha512 else if sha256 != "" then sha256 else if sha1 != "" then sha1 else md5;
+      if sha512 != "" then sha512 else if sha256 != "" then sha256 else sha1;
 
   outputHashMode = if (recursiveHash || executable) then "recursive" else "flat";