cargoHash might be different on linux and darwin systems

[jian-lin]

Describe the bug

The cargoHash might be different on linux and darwin systems. I know that kanata, atuin and trunk-ng have this problem. There are more affected packages.

This problem seems to be caused by the case sensitivity of file systems.

Enabling useFetchCargoVendor solves this.

Additional context

• buildGoModule solves a similar problem using proxyVendor.
• related upstream issues:
  • Cargo packages duplicate files on case-insensitive file systems rust-lang/cargo#13722
  • cargo package includes multiple README files when the case is not all upper-case rust-lang/cargo#14020
• workarounds in Nixpkgs
  • kanata: not needed any more after switching to useFetchCargoVendor
  • samply
  • slippy: not needed any more after switching to useFetchCargoVendor
  • atuin: not needed any more after switching to useFetchCargoVendor

Notify maintainers

@NixOS/rust

---

Add a 👍 reaction to issues you find important.

[SuperSandro2000]

buildGoModule solves a similar problem

That is an upstream feature of go and nothing nixpkgs implements.

[uri-canva]

Note that unless cargo can resolve dependencies differently across OSs (some package managers can switch dependencies based on build os, i don't know of any that can do it based on target os, but I assume there might be, and cargo might be one of them), and the dependencies only contain source code and not outputs / intermediates, then the hashes should always be the same, and any discrepancies are likely to be due to file system case sensitivity issues, bugs in os specific code paths in cargo itself, stuff like that.

Unfortunately I don't know enough about cargo and its ecosystem to say for sure, but wanted to raise it since similar issues pop up in the maintenance of darwin support of other packages in nixpkgs, like the bazel related ones.

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/cargo-lock-considered-harmful/49047/3

[jian-lin]

Two related upstream issues are added.

[kornelski]

Cargo's dependency resolution is platform-independent (Cargo.lock contains the superset of all dependencies for all platforms at the same time). The crate tarballs contain only source code.

However, the tarballs are written out to the local file system by Cargo. If the tarball contains files Foo and fOO, then Cargo will make two separate files on case-sensitive file systems (usually Linux) and only one file on case-insensitive file systems (usually macOS and Windows).

There are many old packages with such error, because when Windows or macOS users had a file named cargo.toml on disk, Cargo would be able to read it as Cargo.toml it asked for, but then it would scan the directory to discover and package other files, and it would make a Linux-centric assumption that cargo.toml is a different file that hasn't been packaged yet. Same thing systematically happened with readme.md vs README.md packaged twice.