headscale/flakehashes.json

{
  "vendor": {
    "goModSum": "sha256-xos6ixeJRMrEengGJaRiSsrm+3S3R0OEsnv1e85Sqhw=",
    "sri": "sha256-bZod9sUUyQ67x/HzZrQ7SK+o5gAUxJhx7Rr6VdIUj1I="
  }
}
cmd/vendorhash: track vendor SRI in flakehashes.json Move the headscale vendorHash out of flake.nix into a content- addressed flakehashes.json maintained by a small Go tool. The schema and goModFingerprint algorithm mirror upstream tailscale's tool/updateflakes so a future shared library extraction is trivial. vendorhash check verifies flakehashes.json against the current go.mod/go.sum. Hot path is a sha256 over those two files, so re-runs without input change are essentially free; only an actual fingerprint drift triggers go mod vendor + nardump.SRI. vendorhash update recomputes both fields and rewrites the JSON. The nix-vendor-sri devShell shim now wraps it. 2026-04-29 07:59:05 +00:00			`{`
			`"vendor": {`
go.mod, go.sum: bump dependencies for v0.29.0 Refresh direct deps (tailscale v1.98.1, modernc.org/sqlite v1.50.1 + libc v1.72.3 lockstep, otel cluster v1.43.0, x/* family, pgx v5.9.2, go-jose v3.0.5, grpc v1.81.1, grpc-gateway v2.29.0) and bulk-update remaining direct deps. tailscale held at v1.98.1 since v1.98.2 demands go 1.26.3 which nixpkgs unstable does not yet ship. 2026-05-19 09:11:15 +00:00			`"goModSum": "sha256-xos6ixeJRMrEengGJaRiSsrm+3S3R0OEsnv1e85Sqhw=",`
			`"sri": "sha256-bZod9sUUyQ67x/HzZrQ7SK+o5gAUxJhx7Rr6VdIUj1I="`
cmd/vendorhash: track vendor SRI in flakehashes.json Move the headscale vendorHash out of flake.nix into a content- addressed flakehashes.json maintained by a small Go tool. The schema and goModFingerprint algorithm mirror upstream tailscale's tool/updateflakes so a future shared library extraction is trivial. vendorhash check verifies flakehashes.json against the current go.mod/go.sum. Hot path is a sha256 over those two files, so re-runs without input change are essentially free; only an actual fingerprint drift triggers go mod vendor + nardump.SRI. vendorhash update recomputes both fields and rewrites the JSON. The nix-vendor-sri devShell shim now wraps it. 2026-04-29 07:59:05 +00:00			`}`
			`}`