From 724289235593f3b120e82f7f385672a8defe75e1 Mon Sep 17 00:00:00 2001 From: Ryan Yin Date: Sat, 19 Sep 2026 13:26:20 +0800 Subject: [PATCH] fix(hardening): refresh wechat source hashes Tencent replaced the file behind the versionless CDN URLs, so the pinned hashes stopped matching. Refresh the x86_64 and aarch64 hashes with nix store prefetch-file. --- hardening/bwraps/wechat.nix | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/hardening/bwraps/wechat.nix b/hardening/bwraps/wechat.nix index f7684b9b..b24111c9 100644 --- a/hardening/bwraps/wechat.nix +++ b/hardening/bwraps/wechat.nix @@ -17,18 +17,21 @@ let sources = { # direct CDN urls, pinned by hash (same approach as nixpkgs' wechat package) # archive.org snapshots are not used because the CDN serves different builds per edge + # NOTE: Tencent replaces the file behind these versionless URLs, so the hashes + # must be refreshed with `nix store prefetch-file` whenever they stop matching. + # Last refreshed: 2026-09-19. aarch64-linux = { version = "4.1.1.8"; src = fetchurl { url = "https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.AppImage"; - hash = "sha256-RLHhac3wSS1C9rx3GsA07Tp1EzxSf2LLBMyPtrECnUY="; + hash = "sha256-zihf1qzRuhY2oKSP3qqIm3bS3/xWZRjRpfONxDe6kRc="; }; }; x86_64-linux = { version = "4.1.1.8"; src = fetchurl { url = "https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.AppImage"; - hash = "sha256-RX26ArkbAxzdRBLu4HT7v/udnQax5Q/Bgi00hw4RSZA="; + hash = "sha256-T1StKQLs1vb9xWgLc1R/gNVCO/RwsBI3pXmi5bPK7us="; }; }; };