refactor(3p/nix): Remove custom base64 implementation r/1462

Replace the custom, rather questionable base64 implementation with
absl::Base64{Une,E}scape. To make sure that the custom implementation
was doing the same thing I've also added a test covering
nix::Hash::to_string, which was one function that used it - the test
passed prior to the replacement, and continued to pass afterwards.

The previous base64Decode function threw an exception on failure - to
avoid going too far down the rabbit hole I've replicated that
functionality at all call sites, but this should be replaced with more
sensible error handling such as StatusOr eventually.

Also, before this change:

    ❯ nix eval -f . users.tazjin.emacs.outPath
    "/nix/store/g6ri2q8nra96ix20bcsc734r1yyaylb1-tazjins-emacs"

And after:

    ❯ ./result/bin/nix eval -f . users.tazjin.emacs.outPath
    "/nix/store/g6ri2q8nra96ix20bcsc734r1yyaylb1-tazjins-emacs"

Change-Id: Id292ffbb82fe808f3f1b34670afbe7b8c13ad615
Reviewed-on: https://cl.tvl.fyi/c/depot/+/1385
Reviewed-by: tazjin <mail@tazj.in>
Tested-by: BuildkiteCI

7 files changed, 56 insertions, 78 deletions

diff --git a/third_party/nix/src/libstore/crypto.cc b/third_party/nix/src/libstore/crypto.cc
index 62b3c05ff9..bec0b08c67 100644
--- a/third_party/nix/src/libstore/crypto.cc
+++ b/third_party/nix/src/libstore/crypto.cc
@@ -1,5 +1,7 @@
 #include "libstore/crypto.hh"
 
+#include <absl/strings/escaping.h>
+
 #include "libstore/globals.hh"
 #include "libutil/util.hh"
 
@@ -27,7 +29,10 @@ Key::Key(const std::string& s) {
     throw Error("secret key is corrupt");
   }
 
-  key = base64Decode(key);
+  if (!absl::Base64Unescape(key, &key)) {
+    // TODO(grfn): replace this with StatusOr
+    throw Error("Invalid Base64");
+  }
 }
 
 SecretKey::SecretKey(const std::string& s) : Key(s) {
@@ -52,7 +57,7 @@ std::string SecretKey::signDetached(const std::string& data) const {
   unsigned long long sigLen;
   crypto_sign_detached(sig, &sigLen, (unsigned char*)data.data(), data.size(),
                        (unsigned char*)key.data());
-  return name + ":" + base64Encode(std::string((char*)sig, sigLen));
+  return name + ":" + absl::Base64Escape(std::string((char*)sig, sigLen));
 #else
   noSodium();
 #endif
@@ -86,7 +91,11 @@ bool verifyDetached(const std::string& data, const std::string& sig,
     return false;
   }
 
-  auto sig2 = base64Decode(ss.second);
+  std::string sig2;
+  if (!absl::Base64Unescape(ss.second, &sig2)) {
+    // TODO(grfn): replace this with StatusOr
+    throw Error("Invalid Base64");
+  }
   if (sig2.size() != crypto_sign_BYTES) {
     throw Error("signature is not valid");
   }
diff --git a/third_party/nix/src/libutil/hash.cc b/third_party/nix/src/libutil/hash.cc
index 5c2ddc4bda..0d80972cce 100644
--- a/third_party/nix/src/libutil/hash.cc
+++ b/third_party/nix/src/libutil/hash.cc
@@ -3,6 +3,7 @@
 #include <cstring>
 #include <iostream>
 
+#include <absl/strings/escaping.h>
 #include <fcntl.h>
 #include <openssl/md5.h>
 #include <openssl/sha.h>
@@ -117,7 +118,9 @@ std::string Hash::to_string(Base base, bool includeType) const {
       break;
     case Base64:
     case SRI:
-      s += base64Encode(std::string((const char*)hash, hashSize));
+      std::string b64;
+      absl::Base64Escape(std::string((const char*)hash, hashSize), &b64);
+      s += b64;
       break;
   }
   return s;
@@ -201,7 +204,11 @@ Hash::Hash(const std::string& s, HashType type) : type(type) {
   }
 
   else if (isSRI || size == base64Len()) {
-    auto d = base64Decode(std::string(s, pos));
+    std::string d;
+    if (!absl::Base64Unescape(std::string(s, pos), &d)) {
+      // TODO(grfn): replace this with StatusOr
+      throw Error("Invalid Base64");
+    }
     if (d.size() != hashSize) {
       throw BadHash("invalid %s hash '%s'", isSRI ? "SRI" : "base-64", s);
     }
diff --git a/third_party/nix/src/libutil/util.cc b/third_party/nix/src/libutil/util.cc
index b97624e58d..f69c341c2c 100644
--- a/third_party/nix/src/libutil/util.cc
+++ b/third_party/nix/src/libutil/util.cc
@@ -1321,73 +1321,6 @@ std::string filterANSIEscapes(const std::string& s, bool filterAll,
   return t;
 }
 
-static char base64Chars[] =
-    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-
-std::string base64Encode(const std::string& s) {
-  std::string res;
-  int data = 0;
-  int nbits = 0;
-
-  for (char c : s) {
-    data = data << 8 | (unsigned char)c;
-    nbits += 8;
-    while (nbits >= 6) {
-      nbits -= 6;
-      res.push_back(base64Chars[data >> nbits & 0x3f]);
-    }
-  }
-
-  if (nbits != 0) {
-    res.push_back(base64Chars[data << (6 - nbits) & 0x3f]);
-  }
-  while ((res.size() % 4) != 0u) {
-    res.push_back('=');
-  }
-
-  return res;
-}
-
-std::string base64Decode(const std::string& s) {
-  bool init = false;
-  char decode[256];
-  if (!init) {
-    // FIXME: not thread-safe.
-    memset(decode, -1, sizeof(decode));
-    for (int i = 0; i < 64; i++) {
-      decode[(int)base64Chars[i]] = i;
-    }
-    init = true;
-  }
-
-  std::string res;
-  unsigned int d = 0;
-  unsigned int bits = 0;
-
-  for (char c : s) {
-    if (c == '=') {
-      break;
-    }
-    if (c == '\n') {
-      continue;
-    }
-
-    char digit = decode[(unsigned char)c];
-    if (digit == -1) {
-      throw Error("invalid character in Base64 string");
-    }
-
-    bits += 6;
-    d = d << 6 | digit;
-    if (bits >= 8) {
-      res.push_back(d >> (bits - 8) & 0xff);
-      bits -= 8;
-    }
-  }
-
-  return res;
-}
-
 void callFailure(const std::function<void(std::exception_ptr exc)>& failure,
                  const std::exception_ptr& exc) {
   try {
diff --git a/third_party/nix/src/libutil/util.hh b/third_party/nix/src/libutil/util.hh
index 0fa15f745c..d9fc1a27b1 100644
--- a/third_party/nix/src/libutil/util.hh
+++ b/third_party/nix/src/libutil/util.hh
@@ -358,10 +358,6 @@ std::string filterANSIEscapes(
     const std::string& s, bool filterAll = false,
     unsigned int width = std::numeric_limits<unsigned int>::max());
 
-/* Base64 encoding/decoding. */
-std::string base64Encode(const std::string& s);
-std::string base64Decode(const std::string& s);
-
 /* Get a value for the specified key from an associate container, or a
    default value if the key doesn't exist. */
 template <class T>
diff --git a/third_party/nix/src/nix-store/nix-store.cc b/third_party/nix/src/nix-store/nix-store.cc
index 7729945b13..1f1e221fc3 100644
--- a/third_party/nix/src/nix-store/nix-store.cc
+++ b/third_party/nix/src/nix-store/nix-store.cc
@@ -2,6 +2,7 @@
 #include <cstdio>
 #include <iostream>
 
+#include <absl/strings/escaping.h>
 #include <fcntl.h>
 #include <glog/logging.h>
 #include <sys/stat.h>
@@ -1170,11 +1171,11 @@ static void opGenerateBinaryCacheKey(Strings opFlags, Strings opArgs) {
   }
 
   writeFile(publicKeyFile, keyName + ":" +
-                               base64Encode(std::string(
+                               absl::Base64Escape(std::string(
                                    (char*)pk, crypto_sign_PUBLICKEYBYTES)));
   umask(0077);
   writeFile(secretKeyFile, keyName + ":" +
-                               base64Encode(std::string(
+                               absl::Base64Escape(std::string(
                                    (char*)sk, crypto_sign_SECRETKEYBYTES)));
 #else
   throw Error(
diff --git a/third_party/nix/src/tests/CMakeLists.txt b/third_party/nix/src/tests/CMakeLists.txt
index b21b194630..724a7a95b5 100644
--- a/third_party/nix/src/tests/CMakeLists.txt
+++ b/third_party/nix/src/tests/CMakeLists.txt
@@ -11,6 +11,14 @@ target_link_libraries(attr-set
 
 gtest_discover_tests(attr-set)
 
+add_executable(hash_test hash_test.cc)
+target_link_libraries(hash_test
+  nixutil
+  GTest::gtest_main
+)
+
+gtest_discover_tests(hash_test)
+
 add_executable(value-to-json value-to-json.cc)
 target_link_libraries(value-to-json
   nixexpr
diff --git a/third_party/nix/src/tests/hash_test.cc b/third_party/nix/src/tests/hash_test.cc
new file mode 100644
index 0000000000..c56fa93757
--- /dev/null
+++ b/third_party/nix/src/tests/hash_test.cc
@@ -0,0 +1,24 @@
+#include "libutil/hash.hh"
+
+#include <gtest/gtest.h>
+
+class HashTest : public ::testing::Test {};
+
+namespace nix {
+
+TEST(HASH_TEST, SHA256) {
+  auto hash = hashString(HashType::htSHA256, "foo");
+  ASSERT_EQ(hash.base64Len(), 44);
+  ASSERT_EQ(hash.base32Len(), 52);
+  ASSERT_EQ(hash.base16Len(), 64);
+
+  ASSERT_EQ(hash.to_string(Base16),
+            "sha256:"
+            "2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae");
+  ASSERT_EQ(hash.to_string(Base32),
+            "sha256:1bp7cri8hplaz6hbz0v4f0nl44rl84q1sg25kgwqzipzd1mv89ic");
+  ASSERT_EQ(hash.to_string(Base64),
+            "sha256:LCa0a2j/xo/5m0U8HTBBNBNCLXBkg7+g+YpeiGJm564=");
+}
+
+}  // namespace nix