nix build of `rain` fails on a cache miss: cargoLock fetches crates from crates.io API, which now returns 403

[hardyjosh]

Symptom

Any consumer that builds packages.rain from source (a Cachix miss) fails while vendoring crates:

building '/nix/store/4bzrfxhdpva1ja0iddw1ja77y0z6g9x5-crate-alloy-1.8.3.tar.gz.drv'...
error: builder for '…-crate-alloy-1.8.3.tar.gz.drv' failed with exit code 1;
       > trying https://crates.io/api/v1/crates/alloy/1.8.3/download
       > curl: (22) The requested URL returned error: 403

Seen on rainlanguage/raindex git-clean / copy-artifacts for every PR since the rain-deploy 0.1.8 bump (new closure, no cache hit): https://github.com/rainlanguage/raindex/actions/runs/34754720078 — script/build-meta.sh runs nix shell .#rain-cli, which is this package.

Cause

flake.nix builds rain with cargoLock.lockFile = ./Cargo.lock, i.e. nixpkgs importCargoLock. On the nixpkgs that rainix pins (4ba039de, 2026-05-13) that fetcher downloads every crate from https://crates.io/api/v1/crates/<name>/<version>/download, and crates.io now answers 403 to nix's curl User-Agent. nixpkgs moved importCargoLock to static.crates.io on 2026-05-27 (NixOS/nixpkgs f830e611), two weeks after rainix's pin, so the fix never reached rainix consumers.

Options

1. In this repo (smallest): vendor through pkgs.rustPlatform.fetchCargoVendor instead of cargoLock. It pulls from the static.crates.io CDN and exists in the pinned nixpkgs. rainix already does this for its own rainix-static binary and says why in a comment. Cargo.lock has no git dependencies. A working diff, hash computed and nix build .#rain verified locally:

   cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
     src = ./.;
     name = "rain";
     hash = "sha256-TrZzMmDnC07lhfjKdKfwNtrzbeRcxKewqTqmiZD2fic=";
   };

   replacing the two cargoLock.* lines. Consumers then need nix flake update rain.

2. In rainix (systemic): bump nixpkgs past f830e611 so every cargoLock user of rainix.pkgs is covered. Bigger churn (rust-overlay / foundry / solc move with it).

Either way raindex's rain input has to be re-locked afterwards.