GitArchiveInputScheme: Bring back the narHash attribute

This is needed to verify that the source tree served by GitHub hasn't
changed compared to the lock file. Computing the narHash for a nixpkgs
source tree only takes ~0.6s and it's cached. So the cost is fairly
negligible compared to the download time.

src/libfetchers/github.cc

@@ -220,6 +220,25 @@ struct GitArchiveInputScheme : InputScheme
 
         auto accessor = makeZipInputAccessor(CanonPath(store->toRealPath(storePath)));
 
+        /* Compute the NAR hash of the contents of the zip file. This
+           is checked against the NAR hash in the lock file in
+           Input::checkLocks(). */
+        auto key = fmt("zip-nar-hash-%s", store->toRealPath(storePath.to_string()));
+
+        auto cache = getCache();
+
+        auto narHash = [&]() {
+            if (auto narHashS = cache->queryFact(key)) {
+                return Hash::parseSRI(*narHashS);
+            } else {
+                auto narHash = accessor->hashPath(CanonPath::root);
+                cache->upsertFact(key, narHash.to_string(SRI, true));
+                return narHash;
+            }
+        }();
+
+        input2.attrs.insert_or_assign("narHash", narHash.to_string(SRI, true));
+
         auto lastModified = accessor->getLastModified();
         assert(lastModified);
         input2.attrs.insert_or_assign("lastModified", uint64_t(*lastModified));

src/libfetchers/input-accessor.cc

@@ -87,6 +87,16 @@ void InputAccessor::dumpPath(
     dump(path);
 }
 
+Hash InputAccessor::hashPath(
+    const CanonPath & path,
+    PathFilter & filter,
+    HashType ht)
+{
+    HashSink sink(ht);
+    dumpPath(path, sink, filter);
+    return sink.finish().first;
+}
+
 StorePath InputAccessor::fetchToStore(
     ref<Store> store,
     const CanonPath & path,

src/libfetchers/input-accessor.hh

@@ -5,6 +5,7 @@
 #include "archive.hh"
 #include "canon-path.hh"
 #include "repair-flag.hh"
+#include "hash.hh"
 
 namespace nix {
 
@@ -57,6 +58,11 @@ struct InputAccessor : public std::enable_shared_from_this<InputAccessor>
         Sink & sink,
         PathFilter & filter = defaultPathFilter);
 
+    Hash hashPath(
+        const CanonPath & path,
+        PathFilter & filter = defaultPathFilter,
+        HashType ht = htSHA256);
+
     StorePath fetchToStore(
         ref<Store> store,
         const CanonPath & path,