fix(nix): vendor crates via fetchCargoVendor

[hardyjosh]

What

Replaces cargoLock.lockFile / cargoLock.allowBuiltinFetchGit on the rain package with pkgs.rustPlatform.fetchCargoVendor.

Why

cargoLock.* routes through nixpkgs importCargoLock, which on rainix's pinned nixpkgs (4ba039de, 2026-05-13) downloads every crate from https://crates.io/api/v1/crates/<name>/<ver>/download. crates.io now answers HTTP 403 to the User-Agent nix's fetcher sends, so the build fails at fetch time for anyone who misses the Cachix cache.

That is the failure in rainlanguage/raindex git-clean / copy-artifacts:

error: builder for '/nix/store/…-crate-alloy-1.8.3.tar.gz.drv' failed …
curl: (22) The requested URL returned error: 403

https://github.com/rainlanguage/raindex/actions/runs/34754720078

nixpkgs fixed importCargoLock to use static.crates.io in f830e611 (2026-05-27) — after rainix's pin, so we can't just wait for it. fetchCargoVendor already exists in the pinned nixpkgs and pulls from the static.crates.io CDN, which serves nix fine. rainix itself vendors its own rainix-static package this way for exactly this reason.

Cargo.lock has zero git dependencies, so dropping allowBuiltinFetchGit costs nothing. No flake.lock / rainix input changes.

Verification (local)

• nix build .#rain -L — succeeds end to end; vendor hash sha256-TrZzMmDnC07lhfjKdKfwNtrzbeRcxKewqTqmiZD2fic=
• ./result/bin/rain --help — runs
• pre-commit run --all-files (rainix rust-shell) — all hooks pass
• rainix-rs-static — pass
• cargo test — pass
• reuse lint — compliant

Consumers

Downstream repos that take rain.cli as a flake input (e.g. raindex's rain input) need a nix flake update rain after this merges to pick the fix up.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HiqQdxokJ4edjAFyAkN9G3

Summary by CodeRabbit

• Chores
  • Updated the build process to use a fixed, vendored set of Rust dependencies.
  • Improved build reproducibility by sourcing dependencies from a stable package archive.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 59bc053e-4011-4c2c-9dfb-c65b529419a8

📥 Commits

Reviewing files that changed from the base of the PR and between 2481470 and 0c44911.

📒 Files selected for processing (1)

• flake.nix

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The Rain package build replaces cargoLock fetching with rustPlatform.fetchCargoVendor. Dependencies are sourced from static.crates.io and verified with a fixed hash.

Changes

Cargo dependency vendoring

Layer / File(s)	Summary
Vendor Cargo dependencies flake.nix	The rain package uses cargoDeps with fetchCargoVendor, the Cargo.lock source, and a fixed SHA-256 hash. The previous cargoLock settings are removed.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 0c449

The change uses fixed-hash Cargo vendoring without identified build or dependency-integrity risks and is ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: using fetchCargoVendor to vendor crates in the Nix configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 2026-09-13-vendor-via-fetchcargovendor

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hardyjosh]

Closing per Josh: tracking as an issue rather than a fix PR for now.