fix: content of wasm_hash_url can have extra fields than the hash

e2e/tests-dfx/deps.bash

@@ -228,7 +228,7 @@ Failed to download from url: http://example.com/c.wasm."
   CUSTOM_HASH_A="$(sha256sum .dfx/local/canisters/a/a.wasm | cut -d " " -f 1)"
   jq '.canisters.a.pullable.wasm_hash="'"$CUSTOM_HASH_A"'"' dfx.json | sponge dfx.json
   # B: set dfx:wasm_hash_url
-  echo -n "$(sha256sum .dfx/local/canisters/b/b.wasm.gz | cut -d " " -f 1)" > ../www/b.wasm.gz.sha256
+  echo -n "$(sha256sum .dfx/local/canisters/b/b.wasm.gz)" > ../www/b.wasm.gz.sha256
   jq '.canisters.b.pullable.wasm_hash_url="'"http://localhost:$E2E_WEB_SERVER_PORT/b.wasm.gz.sha256"'"' dfx.json | sponge dfx.json
   # C: set both dfx:wasm_hash and dfx:wasm_hash_url. This should be avoided by providers.
   CUSTOM_HASH_C="$(sha256sum .dfx/local/canisters/c/c.wasm | cut -d " " -f 1)"

src/dfx/src/commands/deps/pull.rs

@@ -305,8 +305,11 @@ async fn get_hash_on_chain(
         let wasm_hash_content = download_file(&wasm_hash_url)
             .await
             .with_context(|| format!("Failed to download wasm_hash from {wasm_hash_url}."))?;
-        let wasm_hash_encoded = String::from_utf8(wasm_hash_content)
+        let wasm_hash_str = String::from_utf8(wasm_hash_content)
             .with_context(|| format!("Content from {wasm_hash_url} is not valid text."))?;
+        // The content might contain the file name (usually from tools like shasum or sha256sum).
+        // We only need the hash part.
+        let wasm_hash_encoded = wasm_hash_str.split_whitespace().next().unwrap();
         Ok(hex::decode(&wasm_hash_encoded)
             .with_context(|| format!("Failed to decode {wasm_hash_encoded} as sha256 hash."))?)
     } else {