From 0c44911cab8e2be8d4bd7e2d010cf61600e7465d Mon Sep 17 00:00:00 2001 From: Josh Hardy Date: Sun, 13 Sep 2026 12:54:07 +0000 Subject: [PATCH] fix(nix): vendor crates via fetchCargoVendor `cargoLock.lockFile` routes through nixpkgs `importCargoLock`, which on rainix's pinned nixpkgs (4ba039de, 2026-05-13) downloads each crate from `https://crates.io/api/v1/crates///download`. crates.io now answers 403 to the User-Agent nix's fetcher sends, so every consumer that misses the Cachix cache fails at fetch time rather than at build time - e.g. rainlanguage/raindex `git-clean / copy-artifacts`, which died on `crate-alloy-1.8.3.tar.gz.drv ... curl: (22) ... error: 403`. nixpkgs fixed `importCargoLock` to use static.crates.io in f830e611 (2026-05-27), which is after rainix's pin, so we cannot wait for it. `pkgs.rustPlatform.fetchCargoVendor` already exists in the pinned nixpkgs and pulls from the static.crates.io CDN, which serves nix fine. rainix itself vendors its own `rainix-static` package this way for exactly this reason. Cargo.lock has no git dependencies, so dropping `allowBuiltinFetchGit` costs nothing. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01HiqQdxokJ4edjAFyAkN9G3 --- flake.nix | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/flake.nix b/flake.nix index 67c1666..7c92cac 100644 --- a/flake.nix +++ b/flake.nix @@ -26,8 +26,16 @@ src = ./.; doCheck = false; name = "rain"; - cargoLock.lockFile = ./Cargo.lock; - cargoLock.allowBuiltinFetchGit = true; + # Vendored through fetchCargoVendor rather than cargoLock: + # cargoLock fetches each crate from the crates.io API, which now + # answers 403 to the curl User-Agent nix sends, so any store miss + # fails the build. fetchCargoVendor pulls from the + # static.crates.io CDN, which does not. + cargoDeps = pkgs.rustPlatform.fetchCargoVendor { + src = ./.; + name = "rain"; + hash = "sha256-TrZzMmDnC07lhfjKdKfwNtrzbeRcxKewqTqmiZD2fic="; + }; buildInputs = rainix.rust-build-inputs.${system}; nativeBuildInputs = rainix.rust-build-inputs.${system}; };