Vendor rainix-static through fetchCargoVendor: crates.io/api now 403s nix

[thedavidmeister]

rainix-static vendors its crates through cargoLock, and cargoLock in the pinned nixpkgs fetches every crate from https://crates.io/api/v1/crates/<name>/<version>/download. crates.io now answers 403 to the curl/… Nixpkgs/… User-Agent nix sends there, so any job whose store lacks a crate (a cache-nix-action miss, or a crate cache.nixos.org never had, like zip-2.4.2) fails to enter the sol-shell at all. git-clean in S01-Issuer/st0x.deploy has failed on every branch since 2026-08-31 with exactly this; the sibling jobs pass only when their cache restores the vendored crate.

The cargo-release override a few lines up already works around the same gate for its own source with fetchCrate { url = "https://static.crates.io/…" } and fetchCargoVendor. This PR gives rainix-static the second half of that shape: cargoDeps = pkgs.rustPlatform.fetchCargoVendor { src = ./rainix-static; … }, which the pinned nixpkgs already points at the static.crates.io CDN. Nothing in rainix names a URL.

Probed from the same host, same crate:

endpoint	nix's UA	descriptive UA
crates.io/api/v1/crates/zip/2.4.2/download	403	200
static.crates.io/crates/zip/2.4.2/download	200	200

QA

• Reproduced before the change: nix build /nix/store/…-crate-zip-2.4.2.tar.gz.drv^out --rebuild on main tries https://crates.io/api/v1/crates/zip/2.4.2/download and gets curl: (22) … 403 four times, the CI failure verbatim.
• After the change: nix build .#rainix-static -L completes, the vendor fixed-output derivation downloads and hashes (sha256-2ZCPiTO11UhhWUAhn3C433VrLfOB+Dlld/B4wh14DXY=, taken from the hash mismatch line of a lib.fakeHash build, not typed), the build's doCheck runs the crate's 203 unit tests green, and nix run .#rainix-static prints its subcommand list.
• Discriminating tests: n/a for a Nix fetch path; the discriminator is the forced re-fetch above, which fails on main and cannot be reached on this branch because the crate no longer goes through that derivation.
• Mutations applied: n/a, no Rust or shell source changes; the hash is the only value, and a wrong hash fails the build by construction (the fakeHash run is that mutation, killed with hash mismatch).
• Oracle: the curl probes above, run outside nix; nixpkgs' fetch-cargo-vendor-util-v2.py (static.crates.io on line 74) and import-cargo-lock.nix (crates.io/api/v1/crates on line 133) at the pinned revision.
• Category check: the ask is that sol-shell entry stop depending on a crates.io endpoint that rejects nix. Covered for rainix-static; cargo-release already was. No other cargoLock use remains in the flake.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EyWWorieTJV9FmMm2JM6Ua

Summary by CodeRabbit

• Bug Fixes
  • Improved package installation reliability by sourcing Rust dependencies from a vendored archive, avoiding failures caused by crates.io API access restrictions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 8a9aec4a-9014-4da8-bc39-7d1be334c56e

📥 Commits

Reviewing files that changed from the base of the PR and between ae3b3ae and 725bbdf.

📒 Files selected for processing (1)

• flake.nix

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The rainix-static derivation in flake.nix now uses fetchCargoVendor with a pinned hash and the static.crates.io source instead of the Cargo lock-file mechanism.

Changes

Rust dependency vendor source

Layer / File(s)	Summary
Vendor Cargo dependencies flake.nix	The rainix-static derivation replaces cargoLock.lockFile with cargoDeps from pkgs.rustPlatform.fetchCargoVendor, using the package source, version, and fixed-output hash.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 725bb

The static package now vendors its pinned Rust dependencies through the CDN-backed source, and the supplied build and runtime validation indicates it is ready to merge.

Suggested reviewers: findolor

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: it vendors rainix-static dependencies with fetchCargoVendor to avoid the crates.io/api HTTP 403 error.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 2026-09-03-rainix-static-fetch-cargo-vendor

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

@coderabbitai assess this PR size classification for the totality of the PR with the following criterias and report it in your comment:

S/M/L PR Classification Guidelines:

This guide helps classify merged pull requests by effort and complexity rather than just line count. The goal is to assess the difficulty and scope of changes after they have been completed.

Small (S)

Characteristics:

• Simple bug fixes, typos, or minor refactoring
• Single-purpose changes affecting 1-2 files
• Documentation updates
• Configuration tweaks
• Changes that require minimal context to review

Review Effort: Would have taken 5-10 minutes

Examples:

• Fix typo in variable name
• Update README with new instructions
• Adjust configuration values
• Simple one-line bug fixes
• Import statement cleanup

Medium (M)

Characteristics:

• Feature additions or enhancements
• Refactoring that touches multiple files but maintains existing behavior
• Breaking changes with backward compatibility
• Changes requiring some domain knowledge to review

Review Effort: Would have taken 15-30 minutes

Examples:

• Add new feature or component
• Refactor common utility functions
• Update dependencies with minor breaking changes
• Add new component with tests
• Performance optimizations
• More complex bug fixes

Large (L)

Characteristics:

• Major feature implementations
• Breaking changes or API redesigns
• Complex refactoring across multiple modules
• New architectural patterns or significant design changes
• Changes requiring deep context and multiple review rounds

Review Effort: Would have taken 45+ minutes

Examples:

• Complete new feature with frontend/backend changes
• Protocol upgrades or breaking changes
• Major architectural refactoring
• Framework or technology upgrades

Additional Factors to Consider

When deciding between sizes, also consider:

• Test coverage impact: More comprehensive test changes lean toward larger classification
• Risk level: Changes to critical systems bump up a size category
• Team familiarity: Novel patterns or technologies increase complexity

Notes:

• the assessment must be for the totality of the PR, that means comparing the base branch to the last commit of the PR
• the assessment output must be exactly one of: S, M or L (single-line comment) in format of: SIZE={S/M/L}
• do not include any additional text, only the size classification
• your assessment comment must not include tips or additional sections
• do NOT tag me or anyone else on your comment