vendorhash

Overview ¶

vendorhash maintains the Nix SRI hash for the Go module vendor tree and stores it in flakehashes.json alongside a content fingerprint of go.mod and go.sum.

Each block records its input fingerprint (goModSum) so that re-runs with no input change are essentially free: the fast path is just a sha256 over two small files. The vendor tree is only re-walked when the fingerprint actually drifts.

Subcommands:

vendorhash check   exit non-zero if flakehashes.json is stale
vendorhash update  recompute and rewrite flakehashes.json

The JSON schema and [goModFingerprint] algorithm mirror upstream tailscale's tool/updateflakes so a future shared library extraction is straightforward.