fix: make mcpp.lock dependency hashes host-independent (#676)

The lock hash for an index dependency was computed with
std::hash<std::string>, whose output is implementation-defined: MSVC
implements it as FNV-1a while libstdc++/libc++ use MurmurHash. The same
dependency therefore landed in mcpp.lock with a different hash on Windows
and Linux, so a clean checkout showed a lock diff after every build while
the fnv1a: prefix was only true on MSVC.

Compute the digest with mcpp::toolchain::hash_string (FNV-1a on every
host), centralised as mcpp::pm::index_package_digest. The git-dependency
lock hash and the git cache directory key use the same deterministic hash.

Pin the cross-platform vectors in a unit test and add e2e assertions to
the SemVer project-index test.

Author: ZheFeng7110

src/build/prepare.cppm

@@ -7840,10 +7840,15 @@ prepare_build(bool print_fingerprint,
             // ── 2. is it on disk ──
             // Cache key: hash(url + refkind + declared ref + resolved commit).
             // For fixed rev/tag deps the declared ref is also the resolved ref.
-            std::hash<std::string> H;
-            auto gitRoot = mcppHome / "git" / std::format("{:016x}",
-                H(spec.git + "|" + spec.gitRefKind + "|" + spec.gitRev
-                  + "|" + resolvedGitRev));
+            // Deterministic across hosts: `std::hash` is not (see the note on
+            // mcpp::pm::index_package_digest). This key names the git cache
+            // directory AND the lock hash below, so a host-dependent hash made
+            // both the cache directory and mcpp.lock differ by platform.
+            auto H = [](std::string_view s) -> std::string {
+                return mcpp::toolchain::hash_string(s);
+            };
+            auto gitRoot = mcppHome / "git" / H(spec.git + "|" + spec.gitRefKind
+                  + "|" + spec.gitRev + "|" + resolvedGitRev);
             std::error_code ec;
             std::filesystem::create_directories(gitRoot.parent_path(), ec);
 
@@ -7917,9 +7922,9 @@ prepare_build(bool print_fingerprint,
                 if (spec.gitRefKind == "branch") source += "@" + resolvedGitRev;
                 root_git_lock_identities[name] = GitLockIdentity{
                     .source = std::move(source),
-                    .hash = std::format("fnv1a:{:016x}", H(spec.git + "|"
+                    .hash = "fnv1a:" + H(spec.git + "|"
                         + spec.gitRefKind + "|" + spec.gitRev + "|"
-                        + resolvedGitRev)),
+                        + resolvedGitRev),
                 };
             }
             sourceCommit = resolvedGitRev;
@@ -14430,8 +14435,7 @@ prepare_build(bool print_fingerprint,
             if (gitIt == root_git_lock_identities.end()) {
                 lp.source = std::format("git+{}#{}={}",
                     spec.git, spec.gitRefKind, spec.gitRev);
-                std::hash<std::string> hasher;
-                lp.hash = std::format("fnv1a:{:016x}", hasher(lp.source));
+                lp.hash = "fnv1a:" + mcpp::toolchain::hash_string(lp.source);
             } else {
                 lp.source = gitIt->second.source;
                 lp.hash = gitIt->second.hash;
@@ -14461,9 +14465,13 @@ prepare_build(bool print_fingerprint,
             // Use a deterministic hash based on namespace + name + version.
             // A future PR can replace this with a real content hash from the
             // xpkg.lua's declared sha256 or from the install plan.
-            std::hash<std::string> hasher;
-            auto hashInput = std::format("{}:{}@{}", sourceIndex, lp.name, lp.version);
-            lp.hash = std::format("fnv1a:{:016x}", hasher(hashInput));
+            //
+            // NOT `std::hash<std::string>`: its output is implementation-defined
+            // (MSVC FNV-1a, libstdc++/libc++ MurmurHash), so the same dependency
+            // used to hash differently on Windows and Linux while the `fnv1a:`
+            // prefix claimed otherwise. `index_package_digest` is FNV-1a on
+            // every host.
+            lp.hash = mcpp::pm::index_package_digest(sourceIndex, lp.name, lp.version);
             lock.packages.push_back(std::move(lp));
         }
         if (!lock.packages.empty() || !lock.indices.empty()) {

src/lockfile.cppm

@@ -33,4 +33,10 @@ write(const Lockfile& lock, const std::filesystem::path& path) {
 inline std::string serialize(const Lockfile& lock)    { return mcpp::pm::serialize(lock); }
 inline std::string compute_hash(const Lockfile& lock) { return mcpp::pm::compute_hash(lock); }
 
+inline std::string index_package_digest(std::string_view indexNamespace,
+                                        std::string_view name,
+                                        std::string_view version) {
+    return mcpp::pm::index_package_digest(indexNamespace, name, version);
+}
+
 } // namespace mcpp::lockfile

src/pm/lock_io.cppm

@@ -16,6 +16,7 @@ export module mcpp.pm.lock_io;
 
 import std;
 import mcpp.libs.toml;
+import mcpp.toolchain.fingerprint;   // hash_string — the cross-platform FNV-1a
 
 export namespace mcpp::pm {
 
@@ -67,6 +68,19 @@ std::expected<void, LockError>     write(const Lockfile& lock, const std::filesy
 std::string serialize(const Lockfile& lock);
 std::string compute_hash(const Lockfile& lock);
 
+// The `hash` field recorded for an index-resolved dependency, as
+// `fnv1a:<16 hex>` over "<indexNamespace>:<name>@<version>".
+//
+// It MUST be computed with a hash whose output is the same on every host.
+// `std::hash<std::string>` is not: MSVC implements it as FNV-1a while
+// libstdc++/libc++ use MurmurHash, so the very same dependency landed in
+// `mcpp.lock` with a different hash on Windows and on Linux — a diff on every
+// checkout, and a `fnv1a:` label that was only true on MSVC. The deterministic
+// FNV-1a in `mcpp.toolchain.fingerprint` is the project's one hash.
+std::string index_package_digest(std::string_view indexNamespace,
+                                 std::string_view name,
+                                 std::string_view version);
+
 } // namespace mcpp::pm
 
 namespace mcpp::pm {
@@ -193,6 +207,13 @@ std::string compute_hash(const Lockfile& lock) {
     return std::format("{:016x}", h);
 }
 
+std::string index_package_digest(std::string_view indexNamespace,
+                                 std::string_view name,
+                                 std::string_view version) {
+    return "fnv1a:" + mcpp::toolchain::hash_string(
+        std::format("{}:{}@{}", indexNamespace, name, version));
+}
+
 std::optional<LockedGitSource> parse_git_source(std::string_view source) {
     constexpr std::string_view prefix = "git+";
     if (!source.starts_with(prefix)) return std::nullopt;

tests/e2e/169_semver_project_index.sh

@@ -139,6 +139,16 @@ grep -q 'version = "2.1.0"' mcpp.lock || {
     echo "FAIL: the lock must record the resolved version, not the constraint"
     exit 1
 }
+# The digest is FNV-1a on EVERY host. It used `std::hash<std::string>`, whose
+# output is implementation-defined (MSVC FNV-1a vs libstdc++/libc++ MurmurHash),
+# so the same dependency produced a different mcpp.lock on Windows and Linux.
+# `acme:acme.gadget@2.1.0` is pinned here; a host-dependent hash fails on one of
+# the two platforms rather than silently drifting.
+grep -q 'hash    = "fnv1a:2adea846f70078bc"' mcpp.lock || {
+    cat mcpp.lock
+    echo "FAIL: acme.gadget 2.1.0 lock hash is not the host-independent FNV-1a"
+    exit 1
+}
 
 "$MCPP" run > run.log 2>&1 || { cat run.log; echo "FAIL: run failed"; exit 1; }
 
@@ -155,5 +165,11 @@ rm -f mcpp.lock
     exit 1
 }
 grep -q '2\.0\.0' mcpp.lock || { cat mcpp.lock; echo "FAIL: expected 2.0.0 pin"; exit 1; }
+# Same host-independent digest contract for the exact-version form.
+grep -q 'hash    = "fnv1a:34544b46fc9621c3"' mcpp.lock || {
+    cat mcpp.lock
+    echo "FAIL: acme.gadget 2.0.0 lock hash is not the host-independent FNV-1a"
+    exit 1
+}
 
 echo "OK"

tests/unit/test_pm_lock_io.cpp

@@ -105,3 +105,17 @@ TEST(PmLockIo, ParseNonGitSourceReturnsNullopt) {
     EXPECT_FALSE(
         mcpp::pm::parse_git_source("git+https://host/repo#bad").has_value());
 }
+
+// The lock digest MUST be the same on every host. It used `std::hash<std::string>`,
+// whose output is implementation-defined — MSVC implements it as FNV-1a, while
+// libstdc++/libc++ use MurmurHash. The same `compat.catch2` therefore landed in
+// mcpp.lock as 50719400df192025 on Windows and f492c0206481c69a on Linux, so a
+// clean checkout showed a lock diff after every command, and the `fnv1a:` prefix
+// was only true on MSVC. These vectors are the cross-platform contract: a
+// host-dependent hash turns them red on one of the two platforms.
+TEST(PmLockIo, IndexPackageDigestIsFnv1aOnEveryHost) {
+    EXPECT_EQ(mcpp::pm::index_package_digest("compat", "compat.catch2", "2.13.10"),
+              "fnv1a:50719400df192025");
+    EXPECT_EQ(mcpp::pm::index_package_digest("acme", "acme.gadget", "2.1.0"),
+              "fnv1a:2adea846f70078bc");
+}