Invalid Fingerprint

[mperillo]

Today I started a new project, but I got an invalid fingerprint:

zig build test
/home/manlio/src/zig/src/codeberg.org/manliop/build.zig.zon:1:2: error: invalid fingerprint: 0x163159c8b695f8c6; if this is a new or forked package, use this value: 0x7ec30896471f0bb7
.{

Why zig used a different value?

Thanks

[vulpesx]

Part of the fingerprint is a checksum of the package name, so if the name changes it invalidates the fingerprint.

The rest of the fingerprint is random.

When a fingerprint is invalid, or missing; zig provides a new, valid, fingerprint you could use.

It is very important that when you make forks you update the fingerprint, even if the name is the same. If you don’t do that then you would be impersonating the original.

[mperillo]

@vulpesx, thanks.

I indeed changed the module name.

[vulpesx]

@mperillo

I indeed changed the module name.

package name.

Modules are just one thing a package can export.

[arisumar25]

I want to jump in into this topic as I keep getting invalid fingerprint on my new project. Whenever I use the fingerprint that zig provide from the error, I keep getting invalid fingerprint and zig decide to give a different fingerprint. Is there something that I miss?

[arisumar25]

Oh never mind. It turns out the invalid fingerprint coming from the dependency package that I just changed its name without updating the fingerprint. However, the error is very misleading that I thought the generated fingerprint is for the new project not the dependency package

[vulpesx]

Was it misleading? Or are you just not familiar enough with zig errors to quickly spot the source of it?

Because zig will tell you exactly where the issue is and, in zig code, how it got there.

[arisumar25]

Ah you are right. I just reproduce the error and did not notice that it tells which dependency causing the error. I missed the hint because the dependency and new project name have quite similar naming. Thanks for pointing that out!

[Kass]

This thread led me down a rabbit hole. Has anyone tried to claim a cute vanity fingerprint for their project yet? CRC32 is quite a choice.

https://codeberg.org/ziglang/zig/src/commit/0d4f3cc675b71dd3729c7aebab5c47b405922cee/src/Package.zig#L9-L30

[castholm]

I (ab)use it for my packages Not the raw fingerprint itself, but its base64url-encoded form as a component of the package hash:

• sdl-0.5.0+3.4.8-​SDL--​k4DpgH323IfF6cEaGzKUdtUQv1azbBmmcv0RMAu.tar.gz
• sdl_linux_deps-0.0.0-​SDL_l​tg8hgAOayMwFN6BhHW3Rs5UPtf6n8m-2qcQHuGS.tar.gz
• zigglgen-0.5.0-​ziggl​tzDLwA0Gk0Pj6QMij1j6Z_jkvGEtGKBM6-YlI_s.tar.gz

More details in this thread:

Vanity package hashes

The Zig package fingerprint is a 64-bit unsigned integer, with its higher 32 bits representing a checksum computed from the packages name and its lower 32 bits being a unique integer identifier used to help disambiguate different packages with the same name. The first 5⅓ characters of the third component of the package hash correspond directly to the identifier half of the fingerprint. .{ .dependencies = .{ .my_package= .{ .url = "https://example.com/my_package.tar.gz",…

[Cloudef]

I used this in zig-aio https://github.com/Cloudef/zig-aio/blob/master/build.zig.zon#L4C5-L4C39