From 5e640a24147f01b26554e3fbdb14d10e9b28ce25 Mon Sep 17 00:00:00 2001 From: Dario Gabriel Lipicar Date: Tue, 8 Sep 2026 13:06:30 -0300 Subject: [PATCH] fix(nix): apply logos-nix's native overlays in mkPkgsWith mkPkgsWith was a bare `import nixpkgs { overlays = extraOverlays; }`, so every module's package set missed logos-nix's crates.io fixes. crates.io returns 403 to any User-Agent starting "curl/" -- exactly what nixpkgs' fetchurl sends -- so a Rust module 403s on any crate the org cache misses. mkLogosModule vendors with `cargoLock`, i.e. through importCargoLock, NOT fetchCargoVendor. #220 wires only the UA overlay, which covers the other fetcher; it is not the one module crates go through. Take logos-nix's `lib.nativeOverlays` list rather than naming entries. Naming them is how the importCargoLock fix reached master applying to nothing, and a third overlay would repeat it. The pinned logos-nix moves to master for the export (nixpkgs stays at e9f00bd8 and the lock keeps all 756 nodes, so nothing else in the closure shifts). An old logos-nix throws rather than silently applying nothing. #220's `lib.optional (logos-nix ? ...)` shape degrades to a no-op on a stale pin and re-opens the 403 with no diagnostic, which is the failure mode this whole chain exists to close. `logos-nix == null` still yields [ ] and is unaffected. Measured on checks.aarch64-darwin.rust-native-dep, reading `urls` off the crate FODs in the realised closure: before 15 crate fetches, all on https://crates.io/api/v1/crates after 12 moved to https://static.crates.io/crates NOT SUFFICIENT ON ITS OWN. The other 11 belong to logos-lidl-gen, built by logos-rust-sdk, which does its own bare `import nixpkgs` (flake.nix:69 and :196) and so is untouched by this. A module build still reaches the 403 endpoint for those until logos-rust-sdk gets the same wiring -- and that is the repo whose doc-tests run started this. Blast radius: the only derivations this change touches are fixed-output ones (the crate tarballs and the *-vendor-staging FODs) plus one new fetch-cargo-vendor-util-ua helper -- 46 of 1284, every root a FOD, so hashDerivationModulo absorbs them and none propagates. Module output paths do move, for the unrelated pre-existing reason that LOGOS_MODULE_BUILDER_ROOT embeds the builder's source path: appending a single no-op comment to lib/common.nix moves them exactly the same way. Co-Authored-By: Claude Opus 5 --- flake.lock | 6 +++--- lib/common.nix | 14 +++++++++++++- 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/flake.lock b/flake.lock index 8fd3bec..009b174 100644 --- a/flake.lock +++ b/flake.lock @@ -5895,11 +5895,11 @@ "nixpkgs-windows": "nixpkgs-windows_4" }, "locked": { - "lastModified": 1786729772, - "narHash": "sha256-7qE/hchFHmaCxoFCI4dtCqv2eHyL6VttgedTas41Lgs=", + "lastModified": 1788882543, + "narHash": "sha256-6CxENvB7siFQXqyTZnhyJVChiHF4hH7EVdt6xeyELIo=", "owner": "logos-co", "repo": "logos-nix", - "rev": "f55bf91b8a723ee5c27c39c773b034255538d280", + "rev": "782d8690bb74c767c90896a71194b58320d700a1", "type": "github" }, "original": { diff --git a/lib/common.nix b/lib/common.nix index 80627ec..c39ee3b 100644 --- a/lib/common.nix +++ b/lib/common.nix @@ -89,6 +89,18 @@ let systems = [ "aarch64-darwin" "x86_64-darwin" "aarch64-linux" "x86_64-linux" ] ++ lib.optional (logos-nix != null) "x86_64-windows"; + # Native sets carry logos-nix's own overlays -- today the two crates.io 403 + # fixes, which are what makes a Rust module's crates fetchable at all. Taking + # the LIST rather than naming entries is deliberate: naming them is how the + # importCargoLock fix shipped reaching nothing. + nativeOverlays = + if logos-nix == null then [ ] + else if logos-nix ? lib.nativeOverlays then logos-nix.lib.nativeOverlays + else throw ("logos-module-builder: the pinned logos-nix predates " + + "lib.nativeOverlays, so Rust modules would vendor crates from " + + "an endpoint crates.io 403s. Bump the logos-nix input past " + + "logos-co/logos-nix#11."); + # THE package-set constructor. Every module's pkgs comes from here, which is # what lets ~40 modules target Windows without each re-deriving the cross # plumbing. @@ -98,7 +110,7 @@ let # exactly what logos-nix.lib.mkWindowsPkgs wraps. mkPkgsWith = extraOverlays: system: if system != "x86_64-windows" then - import nixpkgs { inherit system; overlays = extraOverlays; } + import nixpkgs { inherit system; overlays = nativeOverlays ++ extraOverlays; } else if logos-nix == null then throw ("logos-module-builder: targeting x86_64-windows requires the " + "logos-nix input to be threaded into the builder lib.")