Update check-and-test.yaml

2024-09-12 17:37:13 -04:00 · 2024-09-12 17:24:25 -04:00 · 2024-09-12 16:10:40 -04:00 · 2024-09-10 22:58:17 -04:00 · 2024-09-10 22:57:59 -04:00 · 2024-09-10 22:44:42 -04:00
23 changed files with 1617 additions and 2427 deletions
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@ -0,0 +1,3 @@
+# For -Zbuild-std
+[target.aarch64-unknown-linux-musl]
+rustflags = ["-C", "target-feature=+crt-static", "-C", "link-arg=-lgcc"]
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@ -24,16 +24,16 @@ jobs:
            runner: namespace-profile-default-arm64
          - nix-system: x86_64-darwin
            system: X64-macOS
-            runner: macos-14-large
+            runner: macos-12
          - nix-system: aarch64-darwin
            system: ARM64-macOS
            runner: macos-latest-xlarge
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
      - name: Install Nix on ${{ matrix.systems.system }}
        uses: DeterminateSystems/nix-installer-action@main
-      - name: Set up FlakeHub Cache
-        uses: DeterminateSystems/flakehub-cache-action@main
+      - name: Magic Nix Cache
+        uses: DeterminateSystems/magic-nix-cache-action@main

      - name: Build and cache dev shell for ${{ matrix.systems.nix-system }}
        run: |
@ -45,7 +45,7 @@ jobs:
            nix-store --export $(nix-store -qR ./result) | xz -9 > "${{ env.ARCHIVE_NAME }}"

      - name: Upload magic-nix-cache closure for ${{ matrix.systems.system }}
-        uses: actions/upload-artifact@v4.6.0
+        uses: actions/upload-artifact@v3.1.2
        with:
          # Artifact name
          name: ${{ env.ARTIFACT_KEY }}
--- a/.github/workflows/check-and-test.yaml
+++ b/.github/workflows/check-and-test.yaml
@ -13,17 +13,18 @@ jobs:
      contents: read
      id-token: write
    steps:
-      - uses: actions/checkout@v4
-
-      - name: Check health of flake.lock
-        uses: DeterminateSystems/flake-checker-action@main
-        with:
-          fail-mode: true
+      - uses: actions/checkout@v3

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/magic-nix-cache-action@main

-      - uses: DeterminateSystems/flakehub-cache-action@main
+      - name: Check health of flake.lock
+        uses: DeterminateSystems/flake-checker-action@main
+        # TODO: re-enable fail mode when we find a way to bump Nixpkgs to 24.05
+        # without breaking the static Rust build
+        #with:
+        #  fail-mode: true

      - name: Check Rust formatting
        run: nix develop --command cargo fmt --check
@ -52,23 +53,30 @@ jobs:
          - system: ARM64-Linux
            runner: namespace-profile-default-arm64
          - system: X64-macOS
-            runner: macos-14-large
+            runner: macos-12
          - system: ARM64-macOS
            runner: macos-latest-xlarge
+        extra_nix_installer_args:
+        - "--determinate"
+        - ""
    permissions:
      contents: read
      id-token: write
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3

      - name: Download closure for ${{ matrix.systems.system }}
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@v3
        with:
          name: ${{ env.ARTIFACT_KEY }}
          path: ${{ env.ARTIFACT_KEY }}

      - name: Install Nix on ${{ matrix.systems.system }}
        uses: DeterminateSystems/nix-installer-action@main
+        with:
+          source-pr: 1163
+          extra-args: ${{ matrix.extra_nix_installer_args }}
+      - run: determinate-nixd login github-action

      - name: Test magic-nix-cache-action@main on ${{ matrix.systems.runner }}
        uses: DeterminateSystems/magic-nix-cache-action@main
--- a/.github/workflows/flakehub.yaml
+++ b/.github/workflows/flakehub.yaml
@ -12,7 +12,7 @@ jobs:
      id-token: "write"
      contents: "read"
    steps:
-      - uses: "actions/checkout@v4"
+      - uses: "actions/checkout@v3"
      - uses: "DeterminateSystems/nix-installer-action@main"
      - uses: "DeterminateSystems/flakehub-push@main"
        with:
--- a/.github/workflows/keygen.yaml
+++ b/.github/workflows/keygen.yaml
@ -5,10 +5,10 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/flakehub-cache-action@main
+      - uses: DeterminateSystems/magic-nix-cache-action@main
      - name: Expose GitHub Runtime
        uses: crazy-max/ghaction-github-runtime@v2
      - name: Dump credentials
--- a/.github/workflows/release-branches.yml
+++ b/.github/workflows/release-branches.yml
@ -22,7 +22,7 @@ jobs:
      id-token: write # In order to request a JWT for AWS auth
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v3
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
@ -32,28 +32,28 @@ jobs:
      - name: Create the artifacts directory
        run: rm -rf ./artifacts && mkdir ./artifacts

-      - uses: actions/download-artifact@v4.1.8
+      - uses: actions/download-artifact@v3
        with:
          name: magic-nix-cache-ARM64-macOS
          path: cache-binary-ARM64-macOS
      - name: Persist the cache binary
        run: cp ./cache-binary-ARM64-macOS/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-ARM64-macOS

-      - uses: actions/download-artifact@v4.1.8
+      - uses: actions/download-artifact@v3
        with:
          name: magic-nix-cache-X64-macOS
          path: cache-binary-X64-macOS
      - name: Persist the cache binary
        run: cp ./cache-binary-X64-macOS/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-X64-macOS

-      - uses: actions/download-artifact@v4.1.8
+      - uses: actions/download-artifact@v3
        with:
          name: magic-nix-cache-X64-Linux
          path: cache-binary-X64-Linux
      - name: Persist the cache binary
        run: cp ./cache-binary-X64-Linux/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-X64-Linux

-      - uses: actions/download-artifact@v4.1.8
+      - uses: actions/download-artifact@v3
        with:
          name: magic-nix-cache-ARM64-Linux
          path: cache-binary-ARM64-Linux
--- a/.github/workflows/release-prs.yml
+++ b/.github/workflows/release-prs.yml
@ -31,33 +31,33 @@ jobs:
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v3

      - name: Create the artifacts directory
        run: rm -rf ./artifacts && mkdir ./artifacts

-      - uses: actions/download-artifact@v4.1.8
+      - uses: actions/download-artifact@v3
        with:
          name: magic-nix-cache-ARM64-macOS
          path: cache-binary-ARM64-macOS
      - name: Persist the cache binary
        run: cp ./cache-binary-ARM64-macOS/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-ARM64-macOS

-      - uses: actions/download-artifact@v4.1.8
+      - uses: actions/download-artifact@v3
        with:
          name: magic-nix-cache-X64-macOS
          path: cache-binary-X64-macOS
      - name: Persist the cache binary
        run: cp ./cache-binary-X64-macOS/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-X64-macOS

-      - uses: actions/download-artifact@v4.1.8
+      - uses: actions/download-artifact@v3
        with:
          name: magic-nix-cache-X64-Linux
          path: cache-binary-X64-Linux
      - name: Persist the cache binary
        run: cp ./cache-binary-X64-Linux/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-X64-Linux

-      - uses: actions/download-artifact@v4.1.8
+      - uses: actions/download-artifact@v3
        with:
          name: magic-nix-cache-ARM64-Linux
          path: cache-binary-ARM64-Linux
--- a/.github/workflows/release-tags.yml
+++ b/.github/workflows/release-tags.yml
@ -19,33 +19,33 @@ jobs:
      id-token: write # In order to request a JWT for AWS auth
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v3

      - name: Create the artifacts directory
        run: rm -rf ./artifacts && mkdir ./artifacts

-      - uses: actions/download-artifact@v4.1.8
+      - uses: actions/download-artifact@v3
        with:
          name: magic-nix-cache-ARM64-macOS
          path: cache-binary-ARM64-macOS
      - name: Persist the cache binary
        run: cp ./cache-binary-ARM64-macOS/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-ARM64-macOS

-      - uses: actions/download-artifact@v4.1.8
+      - uses: actions/download-artifact@v3
        with:
          name: magic-nix-cache-X64-macOS
          path: cache-binary-X64-macOS
      - name: Persist the cache binary
        run: cp ./cache-binary-X64-macOS/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-X64-macOS

-      - uses: actions/download-artifact@v4.1.8
+      - uses: actions/download-artifact@v3
        with:
          name: magic-nix-cache-X64-Linux
          path: cache-binary-X64-Linux
      - name: Persist the cache binary
        run: cp ./cache-binary-X64-Linux/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-X64-Linux

-      - uses: actions/download-artifact@v4.1.8
+      - uses: actions/download-artifact@v3
        with:
          name: magic-nix-cache-ARM64-Linux
          path: cache-binary-ARM64-Linux
--- a/.github/workflows/update-flake-lock.yaml
+++ b/.github/workflows/update-flake-lock.yaml
@ -1,20 +0,0 @@
-name: update-flake-lock
-
-on:
-  workflow_dispatch: # enable manual triggering
-  schedule:
-    - cron: "0 0 * * 0" # every Sunday at midnight
-
-jobs:
-  lockfile:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/flakehub-cache-action@main
-      - uses: DeterminateSystems/update-flake-lock@main
-        with:
-          pr-title: Update flake.lock
-          pr-labels: |
-            dependencies
-            automated
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/README.md
+++ b/README.md
@ -1,12 +1,5 @@
 # Magic Nix Cache

-> [!WARNING]
-> The [Magic Nix Cache will will stop working](https://determinate.systems/posts/magic-nix-cache-free-tier-eol) on **February 1st, 2025** unless you're on [GitHub Enterprise Server](https://github.com/enterprise).
->
-> You can upgrade to [FlakeHub Cache](https://flakehub.com/cache) and get **one month free** using the coupon code **`FHC`**.
->
-> For more information, read [this blog post](https://determinate.systems/posts/magic-nix-cache-free-tier-eol/).
-
 Save 30-50%+ of CI time without any effort or cost.
 Use Magic Nix Cache, a totally free and zero-configuration binary cache for Nix on GitHub Actions.

@ -17,7 +10,7 @@ permissions:
  contents: read
  id-token: write
 steps:
-  - uses: actions/checkout@v4
+  - uses: actions/checkout@v3
  - uses: DeterminateSystems/nix-installer-action@main
  - uses: DeterminateSystems/magic-nix-cache-action@main
  - run: nix flake check
@ -59,7 +52,7 @@ jobs:
      contents: read
      id-token: write
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
      - uses: DeterminateSystems/nix-installer-action@main
      - uses: DeterminateSystems/magic-nix-cache-action@main
      - run: nix flake check
@ -91,8 +84,8 @@ For local development, see `gha-cache/README.md` for more details on how to obta

 ```shell
 cargo run -- -c creds.json --upstream https://cache.nixos.org
-cargo build --release --target x86_64-unknown-linux-gnu
-cargo build --release --target aarch64-unknown-linux-gnu
+cargo build --release --target x86_64-unknown-linux-musl
+cargo build --release --target aarch64-unknown-linux-musl
 nix copy --to 'http://127.0.0.1:3000' $(which bash)
 nix-store --store $PWD/test-root --extra-substituters 'http://localhost:3000' --option require-sigs false -r $(which bash)
 ```
--- a/flake.lock
+++ b/flake.lock
@ -1,27 +1,66 @@
 {
  "nodes": {
    "crane": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
      "locked": {
-        "lastModified": 1741479724,
-        "narHash": "sha256-fnyETBKSVRa5abjOiRG/IAzKZq5yX8U6oRrHstPl4VM=",
-        "rev": "60202a2e3597a3d91f5e791aab03f45470a738b5",
-        "revCount": 709,
+        "lastModified": 1714842444,
+        "narHash": "sha256-z4HeSYtEdYxKurrbxCMb8v/I1LYDHR/aFrZtGtgUgHw=",
+        "rev": "c5ee4371eea1728ef04bb09c79577c84d5e67a48",
+        "revCount": 557,
        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/ipetkov/crane/0.20.2/0195784b-915b-7d2d-915d-ab02d1112ef9/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/ipetkov/crane/0.16.6/018f4495-627e-7385-b537-81f1c1d4003b/source.tar.gz"
      },
      "original": {
        "type": "tarball",
-        "url": "https://flakehub.com/f/ipetkov/crane/%2A"
+        "url": "https://flakehub.com/f/ipetkov/crane/0.16.3.tar.gz"
+      }
+    },
+    "fenix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-analyzer-src": "rust-analyzer-src"
+      },
+      "locked": {
+        "lastModified": 1722493751,
+        "narHash": "sha256-l7/yMehbrL5d4AI8E2hKtNlT50BlUAau4EKTgPg9KcY=",
+        "rev": "60ab4a085ef6ee40f2ef7921ca4061084dd8cf26",
+        "revCount": 1955,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/nix-community/fenix/0.1.1955%2Brev-60ab4a085ef6ee40f2ef7921ca4061084dd8cf26/01910d03-2462-7e48-b72e-439d1152bd11/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/nix-community/fenix/0.1.1727.tar.gz"
      }
    },
    "flake-compat": {
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "revCount": 57,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.0.1/018afb31-abd1-7bff-a5e4-cff7e18efb7a/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/edolstra/flake-compat/1.0.1.tar.gz"
+      }
+    },
+    "flake-compat_2": {
      "flake": false,
      "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "lastModified": 1673956053,
+        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
        "owner": "edolstra",
        "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
        "type": "github"
      },
      "original": {
@ -38,11 +77,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1733312601,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "lastModified": 1712014858,
+        "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
        "type": "github"
      },
      "original": {
@ -51,91 +90,75 @@
        "type": "github"
      }
    },
-    "git-hooks-nix": {
-      "inputs": {
-        "flake-compat": [
-          "nix"
-        ],
-        "gitignore": [
-          "nix"
-        ],
-        "nixpkgs": [
-          "nix",
-          "nixpkgs"
-        ],
-        "nixpkgs-stable": [
-          "nix",
-          "nixpkgs"
-        ]
-      },
+    "flake-utils": {
      "locked": {
-        "lastModified": 1734279981,
-        "narHash": "sha256-NdaCraHPp8iYMWzdXAt5Nv6sA3MUzlCiGiR586TCwo0=",
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "rev": "aa9f40c906904ebd83da78e7f328cd8aeaeae785",
+        "lastModified": 1667395993,
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
        "type": "github"
      },
      "original": {
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "libgit2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1697646580,
+        "narHash": "sha256-oX4Z3S9WtJlwvj0uH9HlYcWv+x1hqp8mhXl7HsLu2f0=",
+        "owner": "libgit2",
+        "repo": "libgit2",
+        "rev": "45fd9ed7ae1a9b74b957ef4f337bc3c8b3df01b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "libgit2",
+        "repo": "libgit2",
        "type": "github"
      }
    },
    "nix": {
      "inputs": {
-        "flake-compat": "flake-compat",
+        "flake-compat": "flake-compat_2",
        "flake-parts": "flake-parts",
-        "git-hooks-nix": "git-hooks-nix",
+        "libgit2": "libgit2",
        "nixpkgs": "nixpkgs",
-        "nixpkgs-23-11": "nixpkgs-23-11",
-        "nixpkgs-regression": "nixpkgs-regression"
+        "nixpkgs-regression": "nixpkgs-regression",
+        "pre-commit-hooks": "pre-commit-hooks"
      },
      "locked": {
-        "lastModified": 1742824067,
-        "narHash": "sha256-rBPulEBpn4IiqkPsetuh7BRzT2iGCzZYnogTAsbrvhU=",
-        "rev": "9cb662df7442a1e2c4600fb8ecb2ad613ebc5a95",
-        "revCount": 19496,
+        "lastModified": 1715246928,
+        "narHash": "sha256-5Q1WkpTWH7fkVfYhHDc5r0A+Vc+K5xB1UhzrLzBCrB8=",
+        "rev": "adba2f19a02eaa74336a06a026d3c37af8020559",
+        "revCount": 17044,
        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/NixOS/nix/2.27.1/0195c8c5-1964-7a31-b025-ebf9bfeef991/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nix/2.22.1/018f61d9-3f9a-7ccf-9bfc-174e3a17ab38/source.tar.gz"
      },
      "original": {
        "type": "tarball",
-        "url": "https://flakehub.com/f/NixOS/nix/2"
+        "url": "https://flakehub.com/f/NixOS/nix/%3D2.22.1.tar.gz"
      }
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1734359947,
-        "narHash": "sha256-1Noao/H+N8nFB4Beoy8fgwrcOQLVm9o4zKW1ODaqK9E=",
+        "lastModified": 1709083642,
+        "narHash": "sha256-7kkJQd4rZ+vFrzWu8sTRtta5D1kBG0LSRYAfhtmMlSo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "48d12d5e70ee91fe8481378e540433a7303dbf6a",
+        "rev": "b550fe4b4776908ac2a861124307045f8e717c8e",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "release-24.11",
+        "ref": "release-23.11",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
-    "nixpkgs-23-11": {
-      "locked": {
-        "lastModified": 1717159533,
-        "narHash": "sha256-oamiKNfr2MS6yH64rUn99mIZjc45nGJlj9eGth/3Xuw=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
-        "type": "github"
-      }
-    },
    "nixpkgs-regression": {
      "locked": {
        "lastModified": 1643052045,
@ -154,24 +177,75 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1742422364,
-        "narHash": "sha256-mNqIplmEohk5jRkqYqG19GA8MbQ/D4gQSK0Mu4LvfRQ=",
-        "rev": "a84ebe20c6bc2ecbcfb000a50776219f48d134cc",
-        "revCount": 770807,
+        "lastModified": 1716633019,
+        "narHash": "sha256-xim1b5/HZYbWaZKyI7cn9TJCM6ewNVZnesRr00mXeS4=",
+        "rev": "9d29cd266cebf80234c98dd0b87256b6be0af44e",
+        "revCount": 558675,
        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.770807%2Brev-a84ebe20c6bc2ecbcfb000a50776219f48d134cc/0195b626-8c1d-7fb9-9282-563af3d37ab9/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2311.558675%2Brev-9d29cd266cebf80234c98dd0b87256b6be0af44e/018fb680-a725-7c9d-825e-aadb0901263e/source.tar.gz"
      },
      "original": {
        "type": "tarball",
-        "url": "https://flakehub.com/f/NixOS/nixpkgs/0.1"
+        "url": "https://flakehub.com/f/NixOS/nixpkgs/0.2311.tar.gz"
+      }
+    },
+    "pre-commit-hooks": {
+      "inputs": {
+        "flake-compat": [
+          "nix"
+        ],
+        "flake-utils": "flake-utils",
+        "gitignore": [
+          "nix"
+        ],
+        "nixpkgs": [
+          "nix",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": [
+          "nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1712897695,
+        "narHash": "sha256-nMirxrGteNAl9sWiOhoN5tIHyjBbVi5e2tgZUgZlK3Y=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "40e6053ecb65fcbf12863338a6dcefb3f55f1bf8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
      }
    },
    "root": {
      "inputs": {
        "crane": "crane",
+        "fenix": "fenix",
+        "flake-compat": "flake-compat",
        "nix": "nix",
        "nixpkgs": "nixpkgs_2"
      }
+    },
+    "rust-analyzer-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1722449213,
+        "narHash": "sha256-1na4m2PNH99syz2g/WQ+Hr3RfY7k4H8NBnmkr5dFDXw=",
+        "owner": "rust-lang",
+        "repo": "rust-analyzer",
+        "rev": "c8e41d95061543715b30880932ec3dc24c42d7ae",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rust-lang",
+        "ref": "nightly",
+        "repo": "rust-analyzer",
+        "type": "github"
+      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@ -2,14 +2,24 @@
  description = "GitHub Actions-powered Nix binary cache";

  inputs = {
-    nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.1";
+    nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.2311.tar.gz";

-    crane.url = "https://flakehub.com/f/ipetkov/crane/*";
+    fenix = {
+      url = "https://flakehub.com/f/nix-community/fenix/0.1.1727.tar.gz";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };

-    nix.url = "https://flakehub.com/f/NixOS/nix/2";
+    crane = {
+      url = "https://flakehub.com/f/ipetkov/crane/0.16.3.tar.gz";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    flake-compat.url = "https://flakehub.com/f/edolstra/flake-compat/1.0.1.tar.gz";
+
+    nix.url = "https://flakehub.com/f/NixOS/nix/=2.22.1.tar.gz";
  };

-  outputs = inputs:
+  outputs = { self, nixpkgs, fenix, crane, ... }@inputs:
    let
      supportedSystems = [
        "aarch64-linux"
@ -18,45 +28,69 @@
        "x86_64-darwin"
      ];

-      forEachSupportedSystem = f: inputs.nixpkgs.lib.genAttrs supportedSystems (system: f rec {
-        pkgs = import inputs.nixpkgs {
+      forEachSupportedSystem = f: nixpkgs.lib.genAttrs supportedSystems (system: f rec {
+        pkgs = import nixpkgs {
          inherit system;
          overlays = [
-            inputs.self.overlays.default
+            inputs.nix.overlays.default
+            self.overlays.default
          ];
        };
+        inherit (pkgs) lib;
        inherit system;
      });
+
+      fenixToolchain = system: with fenix.packages.${system};
+        combine ([
+          stable.clippy
+          stable.rustc
+          stable.cargo
+          stable.rustfmt
+          stable.rust-src
+          stable.rust-analyzer
+        ] ++ nixpkgs.lib.optionals (system == "x86_64-linux") [
+          targets.x86_64-unknown-linux-musl.stable.rust-std
+        ] ++ nixpkgs.lib.optionals (system == "aarch64-linux") [
+          targets.aarch64-unknown-linux-musl.stable.rust-std
+        ]);
    in
    {

      overlays.default = final: prev:
      let
-          craneLib = inputs.crane.mkLib final;
+          toolchain = fenixToolchain final.hostPlatform.system;
+          craneLib = (crane.mkLib final).overrideToolchain toolchain;
          crateName = craneLib.crateNameFromCargoToml {
            cargoToml = ./magic-nix-cache/Cargo.toml;
          };

          commonArgs = {
            inherit (crateName) pname version;
-            src = inputs.self;
+            src = self;

            nativeBuildInputs = with final; [
              pkg-config
            ];

            buildInputs = [
-              inputs.nix.packages.${final.stdenv.system}.default
+              final.nix
              final.boost
+            ] ++ final.lib.optionals final.stdenv.isDarwin [
+              final.darwin.apple_sdk.frameworks.SystemConfiguration
+              (final.libiconv.override { enableStatic = true; enableShared = false; })
            ];
+
+            NIX_CFLAGS_LINK = final.lib.optionalString final.stdenv.isDarwin "-lc++abi";
          };

          cargoArtifacts = craneLib.buildDepsOnly commonArgs;
      in
-      {
+      rec {
        magic-nix-cache = craneLib.buildPackage (commonArgs // {
          inherit cargoArtifacts;
        });
+
+        default = magic-nix-cache;
      };

      packages = forEachSupportedSystem ({ pkgs, ... }: rec {
@ -94,16 +128,16 @@
          createChain 200 startFile;
      });

-      devShells = forEachSupportedSystem ({ system, pkgs }: {
+      devShells = forEachSupportedSystem ({ system, pkgs, lib }:
+      let
+          toolchain = fenixToolchain system;
+      in
+      {
        default = pkgs.mkShell {
          packages = with pkgs; [
-            rustc
-            cargo
-            clippy
-            rustfmt
-            rust-analyzer
+            toolchain

-            inputs.nix.packages.${stdenv.system}.default # for linking attic
+            nix # for linking attic
            boost # for linking attic
            bashInteractive
            pkg-config
@ -115,9 +149,13 @@
            bacon

            age
+          ] ++ lib.optionals pkgs.stdenv.isDarwin [
+            libiconv
+            darwin.apple_sdk.frameworks.SystemConfiguration
          ];

-          RUST_SRC_PATH = "${pkgs.rustPlatform.rustcSrc}/library";
+          NIX_CFLAGS_LINK = lib.optionalString pkgs.stdenv.isDarwin "-lc++abi";
+          RUST_SRC_PATH = "${toolchain}/lib/rustlib/src/rust/library";
        };
      });
    };
--- a/gha-cache/Cargo.toml
+++ b/gha-cache/Cargo.toml
@ -16,7 +16,7 @@ serde = { version = "1.0.162", default-features = false, features = ["derive"] }
 serde_json = { version = "1.0.96", default-features = false }
 sha2 = { version = "0.10.6", default-features = false }
 thiserror = "1.0.40"
-tokio = { version = "1.44.2", default-features = false, features = ["io-util"] }
+tokio = { version = "1.28.0", default-features = false, features = ["io-util"] }
 tracing = { version = "0.1.37", default-features = false }
 unicode-bom = "2.0.2"

--- a/gha-cache/src/api.rs
+++ b/gha-cache/src/api.rs
@ -48,8 +48,6 @@ const MAX_CONCURRENCY: usize = 4;

 type Result<T> = std::result::Result<T, Error>;

-pub type CircuitBreakerTrippedCallback = Arc<Box<dyn Fn() + Send + Sync>>;
-
 /// An API error.
 #[derive(Error, Debug)]
 pub enum Error {
@ -84,6 +82,7 @@ pub enum Error {
    TooManyCollisions,
 }

+#[derive(Debug)]
 pub struct Api {
    /// Credentials to access the cache.
    credentials: Credentials,
@ -105,8 +104,6 @@ pub struct Api {

    circuit_breaker_429_tripped: Arc<AtomicBool>,

-    circuit_breaker_429_tripped_callback: CircuitBreakerTrippedCallback,
-
    /// Backend request statistics.
    #[cfg(debug_assertions)]
    stats: RequestStats,
@ -119,7 +116,7 @@ pub struct FileAllocation(CacheId);
 /// The ID of a cache.
 #[derive(Debug, Clone, Copy, Serialize, Deserialize)]
 #[serde(transparent)]
-struct CacheId(pub i64);
+struct CacheId(pub i32);

 /// An API error.
 #[derive(Debug, Clone)]
@ -245,10 +242,7 @@ impl fmt::Display for ApiErrorInfo {
 }

 impl Api {
-    pub fn new(
-        credentials: Credentials,
-        circuit_breaker_429_tripped_callback: CircuitBreakerTrippedCallback,
-    ) -> Result<Self> {
+    pub fn new(credentials: Credentials) -> Result<Self> {
        let mut headers = HeaderMap::new();
        let auth_header = {
            let mut h = HeaderValue::from_str(&format!("Bearer {}", credentials.runtime_token))
@ -279,7 +273,6 @@ impl Api {
            client,
            concurrency_limit: Arc::new(Semaphore::new(MAX_CONCURRENCY)),
            circuit_breaker_429_tripped: Arc::new(AtomicBool::from(false)),
-            circuit_breaker_429_tripped_callback,
            #[cfg(debug_assertions)]
            stats: Default::default(),
        })
@ -373,8 +366,6 @@ impl Api {
                let client = self.client.clone();
                let concurrency_limit = self.concurrency_limit.clone();
                let circuit_breaker_429_tripped = self.circuit_breaker_429_tripped.clone();
-                let circuit_breaker_429_tripped_callback =
-                    self.circuit_breaker_429_tripped_callback.clone();
                let url = self.construct_url(&format!("caches/{}", allocation.0 .0));

                tokio::task::spawn(async move {
@ -411,8 +402,7 @@ impl Api {

                    drop(permit);

-                    circuit_breaker_429_tripped
-                        .check_result(&r, &circuit_breaker_429_tripped_callback);
+                    circuit_breaker_429_tripped.check_result(&r);

                    r
                })
@ -475,8 +465,7 @@ impl Api {
            .check_json()
            .await;

-        self.circuit_breaker_429_tripped
-            .check_result(&res, &self.circuit_breaker_429_tripped_callback);
+        self.circuit_breaker_429_tripped.check_result(&res);

        match res {
            Ok(entry) => Ok(Some(entry)),
@ -519,8 +508,7 @@ impl Api {
            .check_json()
            .await;

-        self.circuit_breaker_429_tripped
-            .check_result(&res, &self.circuit_breaker_429_tripped_callback);
+        self.circuit_breaker_429_tripped.check_result(&res);

        res
    }
@ -547,8 +535,7 @@ impl Api {
            .check()
            .await
        {
-            self.circuit_breaker_429_tripped
-                .check_err(&e, &self.circuit_breaker_429_tripped_callback);
+            self.circuit_breaker_429_tripped.check_err(&e);
            return Err(e);
        }

@ -556,13 +543,10 @@ impl Api {
    }

    fn construct_url(&self, resource: &str) -> String {
-        let mut url = self.credentials.cache_url.clone();
-        if !url.ends_with('/') {
-            url.push('/');
-        }
-        url.push_str("_apis/artifactcache/");
-        url.push_str(resource);
-        url
+        format!(
+            "{}/_apis/artifactcache/{}",
+            self.credentials.cache_url, resource
+        )
    }
 }

@ -623,34 +607,25 @@ async fn handle_error(res: reqwest::Response) -> Error {
 }

 trait AtomicCircuitBreaker {
-    fn check_err(&self, e: &Error, callback: &CircuitBreakerTrippedCallback);
-    fn check_result<T>(
-        &self,
-        r: &std::result::Result<T, Error>,
-        callback: &CircuitBreakerTrippedCallback,
-    );
+    fn check_err(&self, e: &Error);
+    fn check_result<T>(&self, r: &std::result::Result<T, Error>);
 }

 impl AtomicCircuitBreaker for AtomicBool {
-    fn check_result<T>(
-        &self,
-        r: &std::result::Result<T, Error>,
-        callback: &CircuitBreakerTrippedCallback,
-    ) {
+    fn check_result<T>(&self, r: &std::result::Result<T, Error>) {
        if let Err(ref e) = r {
-            self.check_err(e, callback)
+            self.check_err(e)
        }
    }

-    fn check_err(&self, e: &Error, callback: &CircuitBreakerTrippedCallback) {
+    fn check_err(&self, e: &Error) {
        if let Error::ApiError {
            status: reqwest::StatusCode::TOO_MANY_REQUESTS,
-            ..
+            info: ref _info,
        } = e
        {
            tracing::info!("Disabling GitHub Actions Cache due to 429: Too Many Requests");
            self.store(true, Ordering::Relaxed);
-            callback();
        }
    }
 }
--- a/magic-nix-cache/Cargo.toml
+++ b/magic-nix-cache/Cargo.toml
@ -60,6 +60,6 @@ hyper-util = { version = "0.1", features = ["tokio", "server-auto", "http1"] }
 xdg = { version = "2.5.2" }

 [dependencies.tokio]
-version = "1.44.2"
+version = "1.28.0"
 default-features = false
 features = ["fs", "macros", "process", "rt", "rt-multi-thread", "sync"]
--- a/magic-nix-cache/src/api.rs
+++ b/magic-nix-cache/src/api.rs
@ -99,23 +99,17 @@ async fn workflow_finish(
        gha_cache.shutdown().await?;
    }

-    if let Some(attic_state) = state.flakehub_state.write().await.take() {
-        tracing::info!("Waiting for FlakeHub cache uploads to finish");
-        let paths = attic_state.push_session.wait().await?;
-
-        let paths = paths.keys().map(|s| s.name()).collect::<Vec<_>>();
-
-        tracing::info!(?paths, "FlakeHub Cache uploads completed");
-    } else {
-        tracing::info!("FlakeHub cache is not enabled, not uploading anything to it");
-    }
-
    if let Some(sender) = state.shutdown_sender.lock().await.take() {
        sender
            .send(())
            .map_err(|_| Error::Internal("Sending shutdown server message".to_owned()))?;
    }

+    if let Some(attic_state) = state.flakehub_state.write().await.take() {
+        tracing::info!("Waiting for FlakeHub cache uploads to finish");
+        let _paths = attic_state.push_session.wait().await?;
+    }
+
    // NOTE(cole-h): see `init_logging`
    if let Some(logfile) = &state.logfile {
        let logfile_contents = std::fs::read_to_string(logfile)
--- a/magic-nix-cache/src/flakehub.rs
+++ b/magic-nix-cache/src/flakehub.rs
@ -1,6 +1,5 @@
 use crate::env::Environment;
-use crate::error::{Error, Result};
-use crate::DETERMINATE_NETRC_PATH;
+use crate::error::{self, Error, Result};
 use anyhow::Context;
 use attic::cache::CacheName;
 use attic::nix_store::{NixStore, StorePath};
@ -14,8 +13,7 @@ use attic_client::{
 use reqwest::header::HeaderValue;
 use reqwest::Url;
 use serde::Deserialize;
-use std::os::unix::fs::MetadataExt;
-use std::path::{Path, PathBuf};
+use std::path::Path;
 use std::sync::Arc;
 use tokio::fs::File;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
@ -34,21 +32,74 @@ pub struct State {
 pub async fn init_cache(
    environment: Environment,
    flakehub_api_server: &Url,
+    flakehub_api_server_netrc: &Path,
    flakehub_cache_server: &Url,
-    flakehub_flake_name: &Option<String>,
+    flakehub_flake_name: Option<String>,
    store: Arc<NixStore>,
-    auth_method: &super::FlakeHubAuthSource,
+    using_dnixd: bool,
 ) -> Result<State> {
+    if using_dnixd {
+        let dnixd_state_dir: &Path = Path::new(&crate::DETERMINATE_STATE_DIR);
+        let expected_netrc_path = dnixd_state_dir.join("netrc");
+        if flakehub_api_server_netrc != expected_netrc_path {
+            let err = format!("flakehub-api-server-netrc was ({}), expected ({}) since determinate-nixd is available", flakehub_api_server_netrc.display(), expected_netrc_path.display());
+            return Err(error::Error::Config(err));
+        }
+    }
    // Parse netrc to get the credentials for api.flakehub.com.
-    let netrc_path = auth_method.as_path_buf();
-    let NetrcInfo {
-        netrc,
-        flakehub_cache_server_hostname,
-        flakehub_login,
-        flakehub_password,
-    } = extract_info_from_netrc(&netrc_path, flakehub_api_server, flakehub_cache_server).await?;
+    let netrc = {
+        let mut netrc_file = File::open(flakehub_api_server_netrc).await.map_err(|e| {
+            Error::Internal(format!(
+                "Failed to open {}: {}",
+                flakehub_api_server_netrc.display(),
+                e
+            ))
+        })?;
+        let mut netrc_contents = String::new();
+        netrc_file
+            .read_to_string(&mut netrc_contents)
+            .await
+            .map_err(|e| {
+                Error::Internal(format!(
+                    "Failed to read {} contents: {}",
+                    flakehub_api_server_netrc.display(),
+                    e
+                ))
+            })?;
+        netrc_rs::Netrc::parse(netrc_contents, false).map_err(Error::Netrc)?
+    };

-    if let super::FlakeHubAuthSource::Netrc(netrc_path) = auth_method {
+    let flakehub_netrc_entry = {
+        netrc
+            .machines
+            .iter()
+            .find(|machine| {
+                machine.name.as_ref() == flakehub_api_server.host().map(|x| x.to_string()).as_ref()
+            })
+            .ok_or_else(|| Error::MissingCreds(flakehub_api_server.to_string()))?
+            .to_owned()
+    };
+
+    let flakehub_cache_server_hostname = flakehub_cache_server
+        .host()
+        .ok_or_else(|| Error::BadUrl(flakehub_cache_server.to_owned()))?
+        .to_string();
+
+    let flakehub_login = flakehub_netrc_entry.login.as_ref().ok_or_else(|| {
+        Error::Config(format!(
+            "netrc file does not contain a login for '{}'",
+            flakehub_api_server
+        ))
+    })?;
+
+    let flakehub_password = flakehub_netrc_entry.password.ok_or_else(|| {
+        Error::Config(format!(
+            "netrc file does not contain a password for '{}'",
+            flakehub_api_server
+        ))
+    })?;
+
+    if !using_dnixd {
        // Append an entry for the FlakeHub cache server to netrc.
        if !netrc
            .machines
@ -58,12 +109,12 @@ pub async fn init_cache(
            let mut netrc_file = tokio::fs::OpenOptions::new()
                .create(false)
                .append(true)
-                .open(netrc_path)
+                .open(flakehub_api_server_netrc)
                .await
                .map_err(|e| {
                    Error::Internal(format!(
                        "Failed to open {} for appending: {}",
-                        netrc_path.display(),
+                        flakehub_api_server_netrc.display(),
                        e
                    ))
                })?;
@ -80,7 +131,7 @@ pub async fn init_cache(
                .map_err(|e| {
                    Error::Internal(format!(
                        "Failed to write credentials to {}: {}",
-                        netrc_path.display(),
+                        flakehub_api_server_netrc.display(),
                        e
                    ))
                })?;
@ -98,40 +149,23 @@ pub async fn init_cache(

    // Periodically refresh JWT in GitHub Actions environment
    if environment.is_github_actions() {
-        match auth_method {
-            super::FlakeHubAuthSource::Netrc(path) => {
-                let netrc_path_clone = path.to_path_buf();
-                let initial_github_jwt_clone = flakehub_password.clone();
-                let flakehub_cache_server_clone = flakehub_cache_server.to_string();
-                let api_clone = api.clone();
+        // NOTE(cole-h): This is a workaround -- at the time of writing, GitHub Actions JWTs are only
+        // valid for 5 minutes after being issued. FlakeHub uses these JWTs for authentication, which
+        // means that after those 5 minutes have passed and the token is expired, FlakeHub (and by
+        // extension FlakeHub Cache) will no longer allow requests using this token. However, GitHub
+        // gives us a way to repeatedly request new tokens, so we utilize that and refresh the token
+        // every 2 minutes (less than half of the lifetime of the token).
+        let netrc_path_clone = flakehub_api_server_netrc.to_path_buf();
+        let initial_github_jwt_clone = flakehub_password.clone();
+        let flakehub_cache_server_clone = flakehub_cache_server.to_string();
+        let api_clone = api.clone();

-                tokio::task::spawn(refresh_github_actions_jwt_worker(
-                    netrc_path_clone,
-                    initial_github_jwt_clone,
-                    flakehub_cache_server_clone,
-                    api_clone,
-                ));
-            }
-            crate::FlakeHubAuthSource::DeterminateNixd => {
-                let api_clone = api.clone();
-                let netrc_file = PathBuf::from(DETERMINATE_NETRC_PATH);
-                let flakehub_api_server_clone = flakehub_api_server.clone();
-                let flakehub_cache_server_clone = flakehub_cache_server.clone();
-
-                let initial_meta = tokio::fs::metadata(&netrc_file).await.map_err(|e| {
-                    Error::Io(e, format!("getting metadata of {}", netrc_file.display()))
-                })?;
-                let initial_inode = initial_meta.ino();
-
-                tokio::task::spawn(refresh_determinate_token_worker(
-                    netrc_file,
-                    initial_inode,
-                    flakehub_api_server_clone,
-                    flakehub_cache_server_clone,
-                    api_clone,
-                ));
-            }
-        }
+        tokio::task::spawn(refresh_github_actions_jwt_worker(
+            netrc_path_clone,
+            initial_github_jwt_clone,
+            flakehub_cache_server_clone,
+            api_clone,
+        ));
    }

    // Get the cache UUID for this project.
@ -210,72 +244,6 @@ pub async fn init_cache(
    Ok(state)
 }

-#[derive(Debug)]
-struct NetrcInfo {
-    netrc: netrc_rs::Netrc,
-    flakehub_cache_server_hostname: String,
-    flakehub_login: String,
-    flakehub_password: String,
-}
-
-#[tracing::instrument]
-async fn extract_info_from_netrc(
-    netrc_path: &Path,
-    flakehub_api_server: &Url,
-    flakehub_cache_server: &Url,
-) -> Result<NetrcInfo> {
-    let netrc = {
-        let mut netrc_file = File::open(netrc_path).await.map_err(|e| {
-            Error::Internal(format!("Failed to open {}: {}", netrc_path.display(), e))
-        })?;
-        let mut netrc_contents = String::new();
-        netrc_file
-            .read_to_string(&mut netrc_contents)
-            .await
-            .map_err(|e| {
-                Error::Internal(format!(
-                    "Failed to read {} contents: {}",
-                    netrc_path.display(),
-                    e
-                ))
-            })?;
-        netrc_rs::Netrc::parse(netrc_contents, false).map_err(Error::Netrc)?
-    };
-
-    let flakehub_netrc_entry = netrc
-        .machines
-        .iter()
-        .find(|machine| {
-            machine.name.as_ref() == flakehub_api_server.host().map(|x| x.to_string()).as_ref()
-        })
-        .ok_or_else(|| Error::MissingCreds(flakehub_api_server.to_string()))?
-        .to_owned();
-
-    let flakehub_cache_server_hostname = flakehub_cache_server
-        .host()
-        .ok_or_else(|| Error::BadUrl(flakehub_cache_server.to_owned()))?
-        .to_string();
-    let flakehub_login = flakehub_netrc_entry.login.ok_or_else(|| {
-        Error::Config(format!(
-            "netrc file does not contain a login for '{}'",
-            flakehub_api_server
-        ))
-    })?;
-    let flakehub_password = flakehub_netrc_entry.password.ok_or_else(|| {
-        Error::Config(format!(
-            "netrc file does not contain a password for '{}'",
-            flakehub_api_server
-        ))
-    })?;
-
-    Ok(NetrcInfo {
-        netrc,
-        flakehub_cache_server_hostname,
-        flakehub_login,
-        flakehub_password,
-    })
-}
-
 pub async fn enqueue_paths(state: &State, store_paths: Vec<StorePath>) -> Result<()> {
    state.push_session.queue_many(store_paths)?;

@ -291,13 +259,6 @@ async fn refresh_github_actions_jwt_worker(
    flakehub_cache_server_clone: String,
    api: Arc<RwLock<ApiClient>>,
 ) -> Result<()> {
-    // NOTE(cole-h): This is a workaround -- at the time of writing, GitHub Actions JWTs are only
-    // valid for 5 minutes after being issued. FlakeHub uses these JWTs for authentication, which
-    // means that after those 5 minutes have passed and the token is expired, FlakeHub (and by
-    // extension FlakeHub Cache) will no longer allow requests using this token. However, GitHub
-    // gives us a way to repeatedly request new tokens, so we utilize that and refresh the token
-    // every 2 minutes (less than half of the lifetime of the token).
-
    // TODO(cole-h): this should probably be half of the token's lifetime ((exp - iat) / 2), but
    // getting this is nontrivial so I'm not going to do it until GitHub changes the lifetime and
    // breaks this.
@ -416,77 +377,3 @@ async fn rewrite_github_actions_token(

    Ok(new_github_jwt_string)
 }
-
-#[tracing::instrument(skip_all)]
-async fn refresh_determinate_token_worker(
-    netrc_file: PathBuf,
-    mut inode: u64,
-    flakehub_api_server: Url,
-    flakehub_cache_server: Url,
-    api_clone: Arc<RwLock<ApiClient>>,
-) {
-    // NOTE(cole-h): This is a workaround -- at the time of writing, determinate-nixd handles the
-    // GitHub Actions JWT refreshing for us, which means we don't know when this will happen. At the
-    // moment, it does it roughly every 2 minutes (less than half of the total lifetime of the
-    // issued token).
-
-    loop {
-        tokio::time::sleep(std::time::Duration::from_secs(3)).await;
-
-        let meta = tokio::fs::metadata(&netrc_file)
-            .await
-            .map_err(|e| Error::Io(e, format!("getting metadata of {}", netrc_file.display())));
-
-        let Ok(meta) = meta else {
-            tracing::error!(e = ?meta);
-            continue;
-        };
-
-        let current_inode = meta.ino();
-
-        if current_inode == inode {
-            tracing::debug!("current inode is the same, file didn't change");
-            continue;
-        }
-
-        tracing::debug!("current inode is different, file changed");
-        inode = current_inode;
-
-        let flakehub_password = match extract_info_from_netrc(
-            &netrc_file,
-            &flakehub_api_server,
-            &flakehub_cache_server,
-        )
-        .await
-        {
-            Ok(NetrcInfo {
-                flakehub_password, ..
-            }) => flakehub_password,
-            Err(e) => {
-                tracing::error!(?e, "Failed to extract auth info from netrc");
-                continue;
-            }
-        };
-
-        let server_config = ServerConfig {
-            endpoint: flakehub_cache_server.to_string(),
-            token: Some(attic_client::config::ServerTokenConfig::Raw {
-                token: flakehub_password,
-            }),
-        };
-
-        let new_api = ApiClient::from_server_config(server_config.clone());
-
-        let Ok(new_api) = new_api else {
-            tracing::error!(e = ?new_api, "Failed to construct new ApiClient");
-            continue;
-        };
-
-        {
-            let mut api_client = api_clone.write().await;
-            *api_client = new_api;
-        }
-
-        tracing::debug!("Stored new token in API client, sleeping for 30s");
-    }
-}
--- a/magic-nix-cache/src/gha.rs
+++ b/magic-nix-cache/src/gha.rs
@ -37,15 +37,7 @@ impl GhaCache {
        metrics: Arc<telemetry::TelemetryReport>,
        narinfo_negative_cache: Arc<RwLock<HashSet<String>>>,
    ) -> Result<GhaCache> {
-        let cb_metrics = metrics.clone();
-        let mut api = Api::new(
-            credentials,
-            Arc::new(Box::new(move || {
-                cb_metrics
-                    .tripped_429
-                    .store(true, std::sync::atomic::Ordering::Relaxed);
-            })),
-        )?;
+        let mut api = Api::new(credentials)?;

        if let Some(cache_version) = &cache_version {
            api.mutate_version(cache_version.as_bytes());
--- a/magic-nix-cache/src/main.rs
+++ b/magic-nix-cache/src/main.rs
@ -23,7 +23,7 @@ mod telemetry;
 mod util;

 use std::collections::HashSet;
-use std::fs::create_dir_all;
+use std::fs::{self, create_dir_all};
 use std::io::Write;
 use std::net::SocketAddr;
 use std::path::{Path, PathBuf};
@ -45,7 +45,6 @@ use gha_cache::Credentials;

 const DETERMINATE_STATE_DIR: &str = "/nix/var/determinate";
 const DETERMINATE_NIXD_SOCKET_NAME: &str = "determinate-nixd.socket";
-const DETERMINATE_NETRC_PATH: &str = "/nix/var/determinate/netrc";

 // TODO(colemickens): refactor, move with other UDS stuff (or all PBH stuff) to new file
 #[derive(Clone, Debug, Serialize, Deserialize)]
@ -60,6 +59,13 @@ type State = Arc<StateInner>;
 /// GitHub Actions-powered Nix binary cache
 #[derive(Parser, Debug)]
 struct Args {
+    /// JSON file containing credentials.
+    ///
+    /// If this is not specified, credentials will be loaded
+    /// from the environment.
+    #[arg(short = 'c', long)]
+    credentials_file: Option<PathBuf>,
+
    /// Address to listen on.
    ///
    /// FIXME: IPv6
@ -111,11 +117,11 @@ struct Args {

    /// Whether to use the GHA cache.
    #[arg(long)]
-    use_gha_cache: Option<Option<CacheTrinary>>,
+    use_gha_cache: bool,

    /// Whether to use the FlakeHub binary cache.
    #[arg(long)]
-    use_flakehub: Option<Option<CacheTrinary>>,
+    use_flakehub: bool,

    /// URL to which to post startup notification.
    #[arg(long)]
@ -130,48 +136,15 @@ struct Args {
    diff_store: bool,
 }

-#[derive(Debug, Clone, Copy, PartialEq, clap::ValueEnum)]
-pub enum CacheTrinary {
-    NoPreference,
-    Enabled,
-    Disabled,
-}
-
-impl From<Option<Option<CacheTrinary>>> for CacheTrinary {
-    fn from(b: Option<Option<CacheTrinary>>) -> Self {
-        match b {
-            None => CacheTrinary::NoPreference,
-            Some(None) => CacheTrinary::Enabled,
-            Some(Some(v)) => v,
-        }
-    }
-}
-
-#[derive(PartialEq, Clone, Copy)]
-pub enum Dnixd {
-    Available,
-    Missing,
-}
-
-impl From<bool> for Dnixd {
-    fn from(b: bool) -> Self {
-        if b {
-            Dnixd::Available
-        } else {
-            Dnixd::Missing
-        }
-    }
-}
-
 impl Args {
    fn validate(&self, environment: env::Environment) -> Result<(), error::Error> {
-        if environment.is_gitlab_ci() && self.github_cache_preference() == CacheTrinary::Enabled {
+        if environment.is_gitlab_ci() && self.use_gha_cache {
            return Err(error::Error::Config(String::from(
                "the --use-gha-cache flag should not be applied in GitLab CI",
            )));
        }

-        if environment.is_gitlab_ci() && self.flakehub_preference() != CacheTrinary::Enabled {
+        if environment.is_gitlab_ci() && !self.use_flakehub {
            return Err(error::Error::Config(String::from(
                "you must set --use-flakehub in GitLab CI",
            )));
@ -179,14 +152,6 @@ impl Args {

        Ok(())
    }
-
-    fn github_cache_preference(&self) -> CacheTrinary {
-        self.use_gha_cache.into()
-    }
-
-    fn flakehub_preference(&self) -> CacheTrinary {
-        self.use_flakehub.into()
-    }
 }

 fn default_nix_conf() -> PathBuf {
@ -228,26 +193,6 @@ struct StateInner {
    original_paths: Option<Mutex<HashSet<PathBuf>>>,
 }

-#[derive(Debug, Clone)]
-pub(crate) enum FlakeHubAuthSource {
-    DeterminateNixd,
-    Netrc(PathBuf),
-}
-
-impl FlakeHubAuthSource {
-    pub(crate) fn as_path_buf(&self) -> PathBuf {
-        match &self {
-            Self::Netrc(path) => path.clone(),
-            Self::DeterminateNixd => {
-                let mut path = PathBuf::from(DETERMINATE_STATE_DIR);
-                path.push("netrc");
-
-                path
-            }
-        }
-    }
-}
-
 async fn main_cli() -> Result<()> {
    let guard = init_logging()?;
    let _tracing_guard = guard.appender_guard;
@ -261,9 +206,9 @@ async fn main_cli() -> Result<()> {

    let dnixd_uds_socket_dir: &Path = Path::new(&DETERMINATE_STATE_DIR);
    let dnixd_uds_socket_path = dnixd_uds_socket_dir.join(DETERMINATE_NIXD_SOCKET_NAME);
-    let dnixd_available: Dnixd = dnixd_uds_socket_path.exists().into();
+    let dnixd_available = dnixd_uds_socket_path.exists();

-    let nix_conf_path: PathBuf = args.nix_conf.clone();
+    let nix_conf_path: PathBuf = args.nix_conf;

    // NOTE: we expect this to point to a user nix.conf
    // we always open/append to it to be able to append the extra-substituter for github-actions cache
@ -277,85 +222,47 @@ async fn main_cli() -> Result<()> {
        .open(&nix_conf_path)
        .with_context(|| "Creating nix.conf")?;

-    // always enable fallback, first
-    nix_conf
-        .write_all(b"fallback = true\n")
-        .with_context(|| "Setting fallback in nix.conf")?;
-
    let store = Arc::new(NixStore::connect()?);

    let narinfo_negative_cache = Arc::new(RwLock::new(HashSet::new()));

-    let flakehub_auth_method: Option<FlakeHubAuthSource> = match (
-        args.flakehub_preference(),
-        &args.flakehub_api_server_netrc,
-        dnixd_available,
-    ) {
-        // User has explicitly pyassed --use-flakehub=disabled, so just straight up don't
-        (CacheTrinary::Disabled, _, _) => {
-            tracing::info!("Disabling FlakeHub cache.");
-            None
-        }
+    let flakehub_state = if args.use_flakehub {
+        let flakehub_cache_server = args.flakehub_cache_server;

-        // User has no preference, did not pass a netrc, and determinate-nixd is not available
-        (CacheTrinary::NoPreference, None, Dnixd::Missing) => None,
-
-        // Use it when determinate-nixd is available, and let the user know what's going on
-        (pref, user_netrc_path, Dnixd::Available) => {
-            if pref == CacheTrinary::NoPreference {
-                tracing::info!("Enabling FlakeHub cache because determinate-nixd is available.");
-            }
-
-            if user_netrc_path.is_some() {
-                tracing::info!("Ignoring the user-specified --flakehub-api-server-netrc, in favor of the determinate-nixd netrc");
-            }
-
-            Some(FlakeHubAuthSource::DeterminateNixd)
-        }
-
-        // When determinate-nixd is not available, but the user specified a netrc
-        (_, Some(path), Dnixd::Missing) => {
-            if path.exists() {
-                Some(FlakeHubAuthSource::Netrc(path.to_owned()))
-            } else {
-                tracing::debug!(path = %path.display(), "User-provided netrc does not exist");
-                None
-            }
-        }
-
-        // User explicitly turned on flakehub cache, but we have no netrc and determinate-nixd is not present
-        (CacheTrinary::Enabled, None, Dnixd::Missing) => {
-            return Err(anyhow!(
-                "--flakehub-api-server-netrc is required when determinate-nixd is unavailable"
-            ));
-        }
-    };
-
-    let flakehub_state = if let Some(auth_method) = flakehub_auth_method {
-        let flakehub_cache_server = &args.flakehub_cache_server;
+        let flakehub_api_server_netrc = if dnixd_available {
+            let dnixd_netrc_path = PathBuf::from(DETERMINATE_STATE_DIR).join("netrc");
+            args.flakehub_api_server_netrc.unwrap_or(dnixd_netrc_path)
+        } else {
+            args.flakehub_api_server_netrc.ok_or_else(|| {
+                anyhow!(
+                    "--flakehub-api-server-netrc is required when determinate-nixd is unavailable"
+                )
+            })?
+        };

        let flakehub_api_server = &args.flakehub_api_server;

-        let flakehub_flake_name = &args.flakehub_flake_name;
+        let flakehub_flake_name = args.flakehub_flake_name;

        match flakehub::init_cache(
            environment,
            flakehub_api_server,
-            flakehub_cache_server,
+            &flakehub_api_server_netrc,
+            &flakehub_cache_server,
            flakehub_flake_name,
            store.clone(),
-            &auth_method,
+            dnixd_available,
        )
        .await
        {
            Ok(state) => {
-                if let FlakeHubAuthSource::Netrc(ref path) = auth_method {
+                if !dnixd_available {
                    nix_conf
                        .write_all(
                            format!(
                                "extra-substituters = {}?trusted=1\nnetrc-file = {}\n",
                                &flakehub_cache_server,
-                                path.display()
+                                flakehub_api_server_netrc.display()
                            )
                            .as_bytes(),
                        )
@ -366,24 +273,38 @@ async fn main_cli() -> Result<()> {
                Some(state)
            }
            Err(err) => {
-                tracing::error!("FlakeHub cache initialization failed: {}. Unable to authenticate to FlakeHub. Individuals must register at FlakeHub.com; Organizations must create an organization at FlakeHub.com.", err);
-                println!("::error title={{FlakeHub: Unauthenticated}}::{{Unable to authenticate to FlakeHub. Individuals must register at FlakeHub.com; Organizations must create an organization at FlakeHub.com.}}");
+                tracing::debug!("FlakeHub cache initialization failed: {}", err);
                None
            }
        }
    } else {
-        tracing::info!("FlakeHub cache is disabled.");
+        tracing::info!(
+            "FlakeHub cache is disabled, as the `use-flakehub` setting is set to `false`."
+        );
        None
    };

-    let gha_cache = if (args.github_cache_preference() == CacheTrinary::Enabled)
-        || (args.github_cache_preference() == CacheTrinary::NoPreference
-            && flakehub_state.is_none())
-    {
-        tracing::info!("Loading credentials from environment");
+    let gha_cache = if args.use_gha_cache {
+        let credentials = if let Some(credentials_file) = &args.credentials_file {
+            tracing::info!("Loading credentials from {:?}", credentials_file);
+            let bytes = fs::read(credentials_file).with_context(|| {
+                format!(
+                    "Failed to read credentials file '{}'",
+                    credentials_file.display()
+                )
+            })?;

-        let credentials = Credentials::load_from_env()
-            .with_context(|| "Failed to load credentials from environment (see README.md)")?;
+            serde_json::from_slice(&bytes).with_context(|| {
+                format!(
+                    "Failed to deserialize credentials file '{}'",
+                    credentials_file.display()
+                )
+            })?
+        } else {
+            tracing::info!("Loading credentials from environment");
+            Credentials::load_from_env()
+                .with_context(|| "Failed to load credentials from environment (see README.md)")?
+        };

        let gha_cache = gha::GhaCache::new(
            credentials,
@ -431,7 +352,7 @@ async fn main_cli() -> Result<()> {
        original_paths,
    });

-    if dnixd_available == Dnixd::Available {
+    if dnixd_available {
        tracing::info!("Subscribing to Determinate Nixd build events.");
        crate::pbh::subscribe_uds_post_build_hook(dnixd_uds_socket_path, state.clone()).await?;
    } else {
--- a/magic-nix-cache/src/pbh.rs
+++ b/magic-nix-cache/src/pbh.rs
@ -186,7 +186,13 @@ pub async fn setup_legacy_post_build_hook(

    /* Update nix.conf. */
    nix_conf
-        .write_all(format!("post-build-hook = {}\n", post_build_hook_script.display()).as_bytes())
+        .write_all(
+            format!(
+                "fallback = true\npost-build-hook = {}\n",
+                post_build_hook_script.display()
+            )
+            .as_bytes(),
+        )
        .with_context(|| "Writing to nix.conf")?;

    Ok(())
--- a/magic-nix-cache/src/telemetry.rs
+++ b/magic-nix-cache/src/telemetry.rs
@ -28,8 +28,6 @@ pub struct TelemetryReport {
    pub num_original_paths: Metric,
    pub num_final_paths: Metric,
    pub num_new_paths: Metric,
-
-    pub tripped_429: std::sync::atomic::AtomicBool,
 }

 #[derive(Debug, Default, serde::Serialize)]
--- a/nix.patch
+++ b/nix.patch
@ -0,0 +1,48 @@
+diff --git a/mk/libraries.mk b/mk/libraries.mk
+index 6541775f329..5118b957608 100644
+--- a/mk/libraries.mk
+++ b/mk/libraries.mk
+@@ -130,7 +130,15 @@ define build-library
+ 
+     $(1)_LDFLAGS_USE += $$($(1)_PATH) $$($(1)_LDFLAGS)
+ 
+-    $(1)_INSTALL_PATH := $$(libdir)/$$($(1)_NAME).a
+    $(1)_INSTALL_PATH := $(DESTDIR)$$($(1)_INSTALL_DIR)/$$($(1)_NAME).a
+
+    $$(eval $$(call create-dir, $$($(1)_INSTALL_DIR)))
+
+    $$($(1)_INSTALL_PATH): $$($(1)_OBJS) | $(DESTDIR)$$($(1)_INSTALL_DIR)/
+	+$$(trace-ld) $(LD) -Ur -o $$(_d)/$$($(1)_NAME).o $$^
+	$$(trace-ar) $(AR) crs $$@ $$(_d)/$$($(1)_NAME).o
+
+    install: $$($(1)_INSTALL_PATH)
+ 
+   endif
+ 
+diff --git a/src/libstore/local.mk b/src/libstore/local.mk
+index 8f28bec6c1d..0d41e3c2cac 100644
+--- a/src/libstore/local.mk
+++ b/src/libstore/local.mk
+@@ -69,6 +69,13 @@ $(d)/build.cc:
+ 
+ clean-files += $(d)/schema.sql.gen.hh $(d)/ca-specific-schema.sql.gen.hh
+ 
+$(d)/nix-store.pc: $(d)/nix-store.pc.in
+	$(trace-gen) rm -f $@ && ./config.status --quiet --file=$@
+ifeq ($(BUILD_SHARED_LIBS), 1)
+	sed -i 's|@LIBS_PRIVATE@||' $@
+else
+	sed -i 's|@LIBS_PRIVATE@|Libs.private: $(libstore_LDFLAGS) $(libstore_LDFLAGS_PROPAGATED) $(foreach lib, $(libstore_LIBS), $($(lib)_LDFLAGS))|' $@
+endif
+ $(eval $(call install-file-in, $(d)/nix-store.pc, $(libdir)/pkgconfig, 0644))
+ 
+ $(foreach i, $(wildcard src/libstore/builtins/*.hh), \
+diff --git a/src/libstore/nix-store.pc.in b/src/libstore/nix-store.pc.in
+index 6d67b1e0380..738991d307b 100644
+--- a/src/libstore/nix-store.pc.in
+++ b/src/libstore/nix-store.pc.in
+@@ -7,3 +7,4 @@ Description: Nix Package Manager
+ Version: @PACKAGE_VERSION@
+ Libs: -L${libdir} -lnixstore -lnixutil
+ Cflags: -I${includedir}/nix -std=c++2a
+@LIBS_PRIVATE@
Author	SHA1	Message	Date
Graham Christensen	148e6d6f08	Update check-and-test.yaml	2024-09-12 17:37:13 -04:00
Graham Christensen	11a8a10fbc	Update check-and-test.yaml	2024-09-12 17:24:25 -04:00
Graham Christensen	a270edef6a	Update check-and-test.yaml	2024-09-12 16:10:40 -04:00
Graham Christensen	0ac5c7c096	Update check-and-test.yaml	2024-09-10 22:58:17 -04:00
Graham Christensen	c8d2a9a262	sigh	2024-09-10 22:57:59 -04:00
Graham Christensen	f893565d89	Test with determinate	2024-09-10 22:44:42 -04:00