From 7f01fc3e9f60840bba3403cc072e1f5e31d8edc9 Mon Sep 17 00:00:00 2001
From: baku-ccron <baku-ccron@rainlang.xyz>
Date: Mon, 14 Sep 2026 13:00:10 +0000
Subject: [PATCH] Fetch crates through importCargoLock with an accepted
 User-Agent

fetchCargoVendor hashes Cargo.lock, so the release version bump in
bce8de4 broke every build until re-hashed. importCargoLock needs no
hash; it only needs a fetchurl whose User-Agent crates.io accepts.

Refs rainlanguage/rainix#377

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V8ViHcKLVk2YoS2joH4HdN
---
 flake.nix | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/flake.nix b/flake.nix
index 1d1c928..ebf282c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -26,15 +26,21 @@
                 src = ./.;
                 doCheck = false;
                 name = "rain";
-                # Vendored through fetchCargoVendor rather than cargoLock: cargoLock
-                # fetches each crate from crates.io/api, which answers 403 to the
-                # curl User-Agent nix sends, so any store miss fails the build.
-                # fetchCargoVendor pulls from the static.crates.io CDN.
-                cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
-                  src = ./.;
-                  name = "rain";
-                  hash = "sha256-TrZzMmDnC07lhfjKdKfwNtrzbeRcxKewqTqmiZD2fic=";
-                };
+                # importCargoLock fetches each crate from crates.io/api, which
+                # answers 403 to any User-Agent starting with curl/, and that is
+                # what nixpkgs fetchurl sends. Hand it a fetchurl that overrides
+                # the agent; the fixed-output hashes are unchanged so cache hits
+                # are too. Not fetchCargoVendor: its hash covers Cargo.lock, so the
+                # release version bump would break every build until re-hashed.
+                cargoDeps =
+                  (pkgs.callPackage (pkgs.path + "/pkgs/build-support/rust/import-cargo-lock.nix") {
+                    cargo = rainix.rust-toolchain.${system};
+                    fetchurl = args: pkgs.fetchurl (args // { curlOptsList = (args.curlOptsList or [ ]) ++ [ "--user-agent" "Nixpkgs" ]; });
+                  })
+                    {
+                      lockFile = ./Cargo.lock;
+                      allowBuiltinFetchGit = true;
+                    };
                 buildInputs = rainix.rust-build-inputs.${system};
                 nativeBuildInputs = rainix.rust-build-inputs.${system};
               };