fix(nix): point fetchCrate at static.crates.io too

README.md

@@ -15,6 +15,7 @@ Previously, [`logos-cpp-sdk`](https://github.com/logos-co/logos-cpp-sdk) served
 | `lib.nativeOverlays` | Every overlay that belongs on a Linux/macOS package set, in order, as a list. This is what a consumer doing its own `import nixpkgs { overlays = ...; }` should apply — naming individual `lib.overlays.*` entries means a future overlay silently does not reach it. Never includes the Windows overlays, which must not touch a native set. |
 | `lib.overlays.fetchCargoVendorUserAgent` | Makes `rustPlatform.fetchCargoVendor` send a User-Agent on the current pin (crates.io 403s python-requests' default). Applied by `forAllSystems`/`forAllTargets`/`legacyPackages`; a consumer that does its own `import nixpkgs` should apply `lib.nativeOverlays` rather than naming this one. See `nix/overlays/fetch-cargo-vendor-user-agent.nix`. |
 | `lib.overlays.importCargoLockStaticCratesIo` | Points `rustPlatform.importCargoLock` at `static.crates.io` on the current pin (crates.io's `/api/v1/crates` 403s the `curl/...` User-Agent `fetchurl` sends). This is the fetcher a `cargoLock` build uses; `cargoHash` builds use `fetchCargoVendor` above, so a repo that builds Rust needs whichever matches its packages, or both. Applied by `forAllSystems`/`forAllTargets`/`legacyPackages`; a consumer that does its own `import nixpkgs` should apply `lib.nativeOverlays` rather than naming this one. See `nix/overlays/import-cargo-lock-static-crates-io.nix`. |
+| `lib.overlays.fetchCrateStaticCratesIo` | Points `fetchCrate` at `static.crates.io` on the current pin — the third fetcher, and the one that pulls a crate's own *source* tarball rather than a vendored dependency. Reached from a module closure via qtdeclarative → qtsvg → jasper → libheif (`rav1e`, `cargo-c`). Swaps `fetchCrate`'s own `registryDl` default, so a caller naming a registry still wins. See `nix/overlays/fetch-crate-static-crates-io.nix`. |
 
 ## Usage
 

flake.nix

@@ -77,9 +77,11 @@
       # upstream fix.
       fetchCargoVendorUserAgentOverlay = import ./nix/overlays/fetch-cargo-vendor-user-agent.nix;
       importCargoLockStaticCratesIoOverlay = import ./nix/overlays/import-cargo-lock-static-crates-io.nix;
+      fetchCrateStaticCratesIoOverlay = import ./nix/overlays/fetch-crate-static-crates-io.nix;
       nativeOverlays = [
         fetchCargoVendorUserAgentOverlay
         importCargoLockStaticCratesIoOverlay
+        fetchCrateStaticCratesIoOverlay
       ];
       mkNativePkgs = system: import nixpkgs { inherit system; overlays = nativeOverlays; };
 
@@ -158,6 +160,7 @@
           windowsNative = windowsNativeOverlay;
           fetchCargoVendorUserAgent = fetchCargoVendorUserAgentOverlay;
           importCargoLockStaticCratesIo = importCargoLockStaticCratesIoOverlay;
+          fetchCrateStaticCratesIo = fetchCrateStaticCratesIoOverlay;
         };
       };
 
@@ -264,6 +267,24 @@
           windows-overlay = assert gate;
             pkgs.runCommand "windows-overlay-eval-gate" { } "touch $out";
 
+          # Same for fetchCrate, whose default `registryDl` the overlay swaps.
+          # unpack=false so the probe is a plain fetchurl and exposes `urls`.
+          fetch-crate-overlay =
+            let
+              probe = pkgs.fetchCrate {
+                crateName = "logos-gate-probe";
+                version = "0.0.0";
+                unpack = false;
+                sha256 = lib.fakeSha256;
+              };
+              urls = toString (probe.urls or probe.url);
+            in
+            assert lib.assertMsg (lib.hasInfix "https://static.crates.io/crates" urls)
+              "fetch-crate overlay drift: crate source not on the CDN (${urls})";
+            assert lib.assertMsg (!lib.hasInfix "https://crates.io/api/v1/crates" urls)
+              "fetch-crate overlay drift: API URL survives (${urls})";
+            pkgs.runCommand "fetch-crate-overlay-eval-gate" { } "touch $out";
+
           # Drift guard for the importCargoLock rewrite (the UA overlay asserts
           # on its own hunks). Both failure modes here are silent: a rewrite
           # that stops matching still evaluates, and so does an importCargoLock

nix/overlays/fetch-crate-static-crates-io.nix

@@ -0,0 +1,28 @@
+# Point `fetchCrate` at static.crates.io on the current nixpkgs pin. Same 403 as
+# the two sibling overlays, third fetcher: this one pulls a crate's own SOURCE
+# tarball, not a vendored dependency. logos-co/logos-nix#9 left it alone
+# believing nothing fetched through it -- untrue of a module closure, which
+# reaches rav1e and cargo-c via qtdeclarative -> qtsvg -> jasper -> libheif.
+#
+# `registryDl` is fetchCrate's own documented argument, so a caller naming a
+# registry still wins and no file is re-instantiated.
+final: prev:
+let
+  inherit (prev) lib;
+
+  apiPrefix = "https://crates.io/api/v1/crates";
+  cdnPrefix = "https://static.crates.io/crates";
+
+  fetchCrateFile = prev.path + "/pkgs/build-support/rust/fetchcrate.nix";
+  fetchCrateSrc = builtins.readFile fetchCrateFile;
+
+  alreadyFixed = lib.hasInfix cdnPrefix fetchCrateSrc;
+in
+if alreadyFixed then
+  { }
+else
+  assert lib.assertMsg (lib.hasInfix apiPrefix fetchCrateSrc)
+    "fetch-crate-static-crates-io overlay: ${toString fetchCrateFile} references neither ${apiPrefix} nor ${cdnPrefix}; the registry default moved";
+  {
+    fetchCrate = args: prev.fetchCrate ({ registryDl = cdnPrefix; } // args);
+  }

tests/gate-mutations.sh

@@ -117,6 +117,15 @@ mutate "$DIR/$OVERLAY" 'apiPrefix = "https://crates.io/api/v1/crates";' \
   '  apiPrefix = "https://crates.invalid/nowhere";'
 expect_fail "M5 rewrite matches nothing" "references neither"
 
+# M7 -- the fetchCrate rewrite lands somewhere that is not the CDN. Its own
+# overlay, its own gate; the exports gate covers forgetting to register it.
+prepare m7
+mutate "$DIR/nix/overlays/fetch-crate-static-crates-io.nix" \
+  'cdnPrefix = "https://static.crates.io/crates";' \
+  '  cdnPrefix = "https://mirror.invalid/crates";'
+expect_fail "M7 fetchCrate targets the wrong host" \
+  "crate source not on the CDN (https://mirror.invalid/crates/"
+
 prepare clean
 expect_pass "clean tree passes"