Commit Cargo.lock to make distro source builds easier

[SuperSandro2000]

I am packaging this extension for nixpkgs and we require a Cargo.lock file and the one contained in the sdist is out of date.

[sandhose]

I don't have a strong opinion on having the lock committed, but I'm not sure I get what the advantage over the one in the sdist? That one is generated with the most updated deps at time of release anyway, so it will always be as out of date as the one in the repo

[SuperSandro2000]

I tried using the lock fiel from the sdist but we are using cargo with --frozen and it complained that the lock file was outdated.

matrix-http-rendezvous-synapse> Executing maturinBuildHook
matrix-http-rendezvous-synapse> ++ env CC_x86_64-unknown-linux-gnu=/nix/store/l0fvy72hpfdpjjs3dk4112f57x7r3dlm-gcc-wrapper-12.2.0/bin/cc CXX_x86_64-unknown-linux-gnu=/nix/store/l0fvy72hpfdpjjs3dk4112f57x7r3dlm-gcc-wrapper-12.2.0/bin/c++ CC_x86_64-unknown-linux-gnu=/nix/store/l0fvy72hpfdpjjs3dk4112f57x7r3dlm-gcc-wrapper-12.2.0/bin/cc CXX_x86_64-unknown-linux-gnu=/nix/store/l0fvy72hpfdpjjs3dk4112f57x7r3dlm-gcc-wrapper-12.2.0/bin/c++ maturin build --jobs=4 --frozen --target x86_64-unknown-linux-gnu --manylinux off --strip --release
matrix-http-rendezvous-synapse> error: the lock file /build/matrix_http_rendezvous_synapse-0.1.10/Cargo.lock needs to be updated but --frozen was passed to prevent this
matrix-http-rendezvous-synapse> If you want to try to generate the lock file without accessing the network, remove the --frozen flag and use --offline instead.
matrix-http-rendezvous-synapse> 💥 maturin failed
matrix-http-rendezvous-synapse>   Caused by: Cargo metadata failed. Does your crate compile with `cargo build`?
matrix-http-rendezvous-synapse>   Caused by: `cargo metadata` exited with an error:

The nix build environment I am using has no internet connectivity and can't update the lock file. I would need to patch it beforehand. I am not sure why this is necessary but fixing this on git level seems easier than patching the sdist with every update.

[sandhose]

I assume the --frozen comes from there? https://github.com/NixOS/nixpkgs/blob/d412d7956754408c347291516d1d3e3ea469642b/pkgs/build-support/rust/hooks/maturin-build-hook.sh#L19

I'm not 100% sure, but that should probably be using --locked instead, to install all the dependencies from the lockfile instead of reaching the network... Like here it feels like it is reaching for the network. Can I see your nix derivation somewhere?

I should do a release after #14, so you'll get an updated Cargo.lock in the sdist anyway

[SuperSandro2000]

I'm not 100% sure, but that should probably be using --locked instead, to install all the dependencies from the lockfile instead of reaching the network... Like here it feels like it is reaching for the network. Can I see your nix derivation somewhere?

There is also a cargo vendor step which is documented in https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/rust/hooks/cargo-setup-hook.sh and uses this cargo config file https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/rust/fetchcargo-default-config.toml

The nix expression is here https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/matrix-synapse/plugins/rendezvous.nix