From 4329de1264ecb7cca8709dc1984b86beb11bcc4e Mon Sep 17 00:00:00 2001 From: Yureka Date: Fri, 17 Mar 2023 15:53:44 +0100 Subject: [PATCH] rustPlatform.fetchCargoTarball: fail on git dependencies The reason is that we can not expect the extended logic run on git dependencies starting from Cargo 1.68 to be reproducible in future versions, and thus the output hash would not be sufficiently stable. https://github.com/rust-lang/cargo/pull/11414 --- .../rust/fetch-cargo-tarball/default.nix | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix index 36ab93169741..adbfe98d8103 100644 --- a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix +++ b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix @@ -76,6 +76,17 @@ in stdenv.mkDerivation ({ # Override the `http.cainfo` option usually specified in `.cargo/config`. export CARGO_HTTP_CAINFO=${cacert}/etc/ssl/certs/ca-bundle.crt + if grep '^source = "git' Cargo.lock; then + echo + echo "ERROR: The Cargo.lock contains git dependencies" + echo + echo "This is currently not supported in the fixed-output derivation fetcher." + echo "Use cargoLock.lockFile / importCargoLock instead." + echo + + exit 1 + fi + cargo vendor $name --respect-source-config | cargo-vendor-normalise > $CARGO_CONFIG # Create an empty vendor directory when there is no dependency to vendor