Release builds broken ecosystem-wide: crates.io returns 403 to fetchCargoVendor (UA-less python fetch)

[danisharora099]

Every CI release using the shared release action currently fails during nix vendoring. Evidence: logos-co/eth-lez-atomic-swaps actions runs 29956868665 / 29956875094 (2026-07-22): all build variants fail with

error: Cannot build '/nix/store/…-zerokit-0.9.0-vendor-staging.drv'
Exception: Failed to fetch file from https://crates.io/api/v1/crates/bitflags/2.9.4/download. Status code: 403

Root cause: the pinned nixpkgs' fetchCargoVendor fetches crates with python-requests' default User-Agent, which crates.io now blocks (403). Workaround we used locally: reproduce the fixed-output staging with a proper UA, nix store add it pre-seeded, then build (worked; that's how swap-v0.2.0 / swap_ui-v0.2.0 releases were produced from local artifacts). Fix options: advance the nixpkgs pin to one where fetchCargoVendor sends a proper UA, or patch the fetcher. This blocks every module's release pipeline, not just ours.

The shared workflow that exposes this failure is in logos-co/logos-modules-release-action; the fix belongs here because module flakes follow logos-module-builder's nixpkgs input. Cross-reference: https://github.com/logos-co/logos-modules-release-action

[danisharora099]

Fix is up: #173 (branch danisharora099/logos-module-builder#fix/fetch-cargo-vendor-403).

Root cause confirmed at source level: the pinned nixpkgs (e9f00bd8) builds fetch-cargo-vendor-util with a bare requests.Session() — no User-Agent at all. Upstream added one in NixOS/nixpkgs@8209ba2b (2026-04-26, nixos-unstable only; never backported to 25.05/25.11).

Fix shape: repin to e9f00bd8 + one commit (eaec81d3) that applies the UA only to the fixed-output vendorStaging derivation — FODs are absorbed by hashDerivationModulo, so zero input-addressed store paths change (verified: qt6.qtdeclarative, python3Packages.cryptography, cargo-auditable, and -vendor outputs are byte-identical across pins; only the staging .drv differs). No cache invalidation, no rebuilds, all existing cargoHash values stay valid.

Validation pair (minimal fetchCargoVendor over a lockfile containing bitflags 2.9.4, cold store paths):

Before, at e9f00bd8:

> Exception: Failed to fetch file from https://crates.io/api/v1/crates/bitflags/2.9.4/download. Status code: 403

After, at eaec81d3 (same derivation):

ua-repro> Fetching https://crates.io/api/v1/crates/bitflags/2.9.4/download -> tarballs/bitflags-2.9.4.tar.gz
/nix/store/h41y5c2xdrlmfh61kh3i2rga9l4q9f4f-ua-repro-20260730-vendor

CI-parity acid test: scratch clone of this repo (eth-lez-atomic-swaps), nix build .#lgx-portable in swap-module/ with the fixed builder as --override-input, after nix store delete-ing the pre-seeded swap-ffi/zerokit vendor-staging, vendor, and compiled outputs: the full ~380-crate staging fetch runs cold against crates.io with zero 403s, swap-ffi compiles, lgx bundle assembles → /nix/store/cw3sqm1h…-logos-swap-module-lib-lgx-0.2.0, exit 0.

Three follow-ups surfaced while validating (details in the PR):

1. zerokit vendoring is separately broken: logos-delivery pins its own nixpkgs (23d72dab, also pre-UA-fix) outside this follows chain. Ready-made same-shape patch branch: patch/fetch-cargo-vendor-ua-23d72dab (used in the acid test). Needs a sibling fix in logos-delivery.
2. This repo's committed cargoHash for swap-ffi is stale (sha256-Xu7WL+…): a genuine cold fetch yields sha256-lADceazcOPwMkeBwUElibZ5oMPsLD1gIZdVGkGQfX0E= — cross-confirmed by current nixos-unstable's official (UA-fixed) fetcher producing the identical hash. The pre-seeded-store release workaround was masking this; CI will still fail on it after the nixpkgs fix unless bumped.
3. The nixpkgs patch branch currently lives on a personal fork; maintainers may want to push the same commit to logos-co/nixpkgs (which already hosts patch branches) and flip the owner — rev/narHash identical. Long-term, the proper fix is the pin advance via logos-nix past 2026-04-26.

[danisharora099]

@dlipicar @Khushboo-dev-cpp

[danisharora099]

Fix path as of 2026-08-27, now concrete: logos-co/logos-nix#6 (User-Agent overlay on the current pin, no Qt bump) plus #220 (the one-line hookup applying it here), landing in that order plus a lock bump. #173 is closed in favour of this route. Until they land, every module release that vendors crates still hits the 403.