Merge pull request #137 from DeterminateSystems/dependabot/cargo/crossbeam-channel-0.5.15

build(deps): bump crossbeam-channel from 0.5.14 to 0.5.15

.cargo/config.toml

@@ -1,3 +0,0 @@
-# For -Zbuild-std
-[target.aarch64-unknown-linux-musl]
-rustflags = ["-C", "target-feature=+crt-static", "-C", "link-arg=-lgcc"]

.editorconfig

@@ -0,0 +1,10 @@
+# https://editorconfig.org
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true

.github/workflows/build.yaml

@@ -5,100 +5,49 @@ on:
   workflow_call:
 
 jobs:
-  build-artifacts-ARM64-macOS:
-    runs-on: macos-latest-xlarge
+  build-artifacts:
+    runs-on: ${{ matrix.systems.runner }}
     permissions:
       contents: read
       id-token: write
+    env:
+      ARTIFACT_KEY: magic-nix-cache-${{ matrix.systems.system }}
+      ARCHIVE_NAME: magic-nix-cache.closure.xz
+    strategy:
+      matrix:
+        systems:
+          - nix-system: x86_64-linux
+            system: X64-Linux
+            runner: ubuntu-22.04
+          - nix-system: aarch64-linux
+            system: ARM64-Linux
+            runner: namespace-profile-default-arm64
+          - nix-system: x86_64-darwin
+            system: X64-macOS
+            runner: macos-14-large
+          - nix-system: aarch64-darwin
+            system: ARM64-macOS
+            runner: macos-latest-xlarge
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+      - name: Install Nix on ${{ matrix.systems.system }}
+        uses: DeterminateSystems/nix-installer-action@main
+      - name: Set up FlakeHub Cache
+        uses: DeterminateSystems/flakehub-cache-action@main
 
-      - uses: DeterminateSystems/nix-installer-action@main
+      - name: Build and cache dev shell for ${{ matrix.systems.nix-system }}
+        run: |
+          nix build ".#devShells.${{ matrix.systems.nix-system }}.default"
 
-      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - name: Build package and create closure for ${{ matrix.systems.system }}
+        run: |
+          nix build .# -L --fallback && \
+            nix-store --export $(nix-store -qR ./result) | xz -9 > "${{ env.ARCHIVE_NAME }}"
 
-      - name: Build package
-        run: "nix build .# -L --fallback && nix-store --export $(nix-store -qR ./result) | xz -9 > magic-nix-cache.closure.xz"
-
-      - name: Upload a Build Artifact
-        uses: actions/upload-artifact@v3.1.2
+      - name: Upload magic-nix-cache closure for ${{ matrix.systems.system }}
+        uses: actions/upload-artifact@v4.6.0
         with:
           # Artifact name
-          name: magic-nix-cache-ARM64-macOS
-          path: magic-nix-cache.closure.xz
-          retention-days: 1
-
-  build-artifacts-X64-macOS:
-    runs-on: macos-12
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@v3
-
-      - uses: DeterminateSystems/flake-checker-action@main
-
-      - uses: DeterminateSystems/nix-installer-action@main
-
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-
-      - name: Build package
-        run: "nix build .# -L --fallback && nix-store --export $(nix-store -qR ./result) | xz -9 > magic-nix-cache.closure.xz"
-
-      - name: Upload a Build Artifact
-        uses: actions/upload-artifact@v3.1.2
-        with:
-          # Artifact name
-          name: magic-nix-cache-X64-macOS
-          path: magic-nix-cache.closure.xz
-          retention-days: 1
-
-  build-artifacts-X64-Linux:
-    runs-on: ubuntu-22.04
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@v3
-
-      - uses: DeterminateSystems/flake-checker-action@main
-
-      - uses: DeterminateSystems/nix-installer-action@main
-
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-
-      - name: Build package
-        run: "nix build .# -L --fallback && nix-store --export $(nix-store -qR ./result) | xz -9 > magic-nix-cache.closure.xz"
-
-      - name: Upload a Build Artifact
-        uses: actions/upload-artifact@v3.1.2
-        with:
-          # Artifact name
-          name: magic-nix-cache-X64-Linux
-          path: magic-nix-cache.closure.xz
-          retention-days: 1
-
-  build-artifacts-ARM64-Linux:
-    runs-on: namespace-profile-default-arm64
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@v3
-
-      - uses: DeterminateSystems/flake-checker-action@main
-
-      - uses: DeterminateSystems/nix-installer-action@main
-
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-
-      - name: Build package
-        run: "nix build .# -L --fallback && nix-store --export $(nix-store -qR ./result) | xz -9 > magic-nix-cache.closure.xz"
-
-      - name: Upload a Build Artifact
-        uses: actions/upload-artifact@v3.1.2
-        with:
-          # Artifact name
-          name: magic-nix-cache-ARM64-Linux
-          path: magic-nix-cache.closure.xz
+          name: ${{ env.ARTIFACT_KEY }}
+          path: ${{ env.ARCHIVE_NAME }}
           retention-days: 1

.github/workflows/check-and-test.yaml

@@ -0,0 +1,87 @@
+name: Run checks and integration test
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  checks:
+    name: Nix and Rust checks
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check health of flake.lock
+        uses: DeterminateSystems/flake-checker-action@main
+        with:
+          fail-mode: true
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+
+      - uses: DeterminateSystems/flakehub-cache-action@main
+
+      - name: Check Rust formatting
+        run: nix develop --command cargo fmt --check
+
+      - name: Clippy
+        run: nix develop --command cargo clippy
+
+  build:
+    name: Build artifacts
+    needs: checks
+    uses: ./.github/workflows/build.yaml
+    secrets: inherit
+
+  action-integration-test:
+    name: Integration test for magic-nix-cache-action
+    runs-on: ${{ matrix.systems.runner }}
+    needs: build
+    env:
+      ARTIFACT_KEY: magic-nix-cache-${{ matrix.systems.system }}
+      ARCHIVE_NAME: magic-nix-cache.closure.xz
+    strategy:
+      matrix:
+        systems:
+          - system: X64-Linux
+            runner: ubuntu-22.04
+          - system: ARM64-Linux
+            runner: namespace-profile-default-arm64
+          - system: X64-macOS
+            runner: macos-14-large
+          - system: ARM64-macOS
+            runner: macos-latest-xlarge
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download closure for ${{ matrix.systems.system }}
+        uses: actions/download-artifact@v4.1.8
+        with:
+          name: ${{ env.ARTIFACT_KEY }}
+          path: ${{ env.ARTIFACT_KEY }}
+
+      - name: Install Nix on ${{ matrix.systems.system }}
+        uses: DeterminateSystems/nix-installer-action@main
+
+      - name: Test magic-nix-cache-action@main on ${{ matrix.systems.runner }}
+        uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          source-binary: "${{ env.ARTIFACT_KEY }}/${{ env.ARCHIVE_NAME }}"
+          _internal-strict-mode: true
+
+      - name: Run nix to test magic-nix-cache-action
+        run: |
+          nix develop --command echo "just testing"
+      - name: Exhaust our GitHub Actions Cache tokens
+        # Generally skip this step since it is so intensive
+        if: ${{ false }}
+        run: |
+          date >> README.md
+          nix build .#veryLongChain -v

.github/workflows/checks.yaml

@@ -1,34 +0,0 @@
-name: Rust checks
-
-on:
-  pull_request:
-  push:
-    branches: [main]
-
-jobs:
-  checks:
-    runs-on: ubuntu-22.04
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-
-      - name: Check health of flake.lock
-        uses: DeterminateSystems/flake-checker-action@main
-        with:
-          fail-mode: true
-
-      - name: Check Rust formatting
-        run: nix develop --command cargo fmt --check
-
-      - name: Clippy
-        run: nix develop --command cargo clippy
-
-  build:
-    uses: ./.github/workflows/build.yaml
-    secrets: inherit

.github/workflows/flakehub-cache.yml

@@ -1,32 +0,0 @@
-name: Push dev shell to FlakeHub Cache
-
-on:
-  push:
-    branches: [main]
-
-jobs:
-  push-dev-shell-to-flakehub-cache:
-    env:
-      ACTIONS_STEP_DEBUG: true
-    runs-on: ${{ matrix.systems.runner }}
-    permissions:
-      id-token: "write"
-      contents: "read"
-    strategy:
-      matrix:
-        systems:
-          - nix-system: "aarch64-darwin"
-            runner: "macos-latest-xlarge"
-          - nix-system: "x86_64-darwin"
-            runner: "macos-12"
-          - nix-system: "x86_64-linux"
-            runner: "ubuntu-22.04"
-    steps:
-      - uses: actions/checkout@v3
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-        with:
-          use-flakehub: true
-      - name: Build dev shell for ${{ matrix.systems.nix-system }} on ${{ matrix.systems.runner }}
-        run: |
-          nix build .#devShells.${{ matrix.systems.nix-system }}.default

.github/workflows/flakehub.yaml

@@ -0,0 +1,21 @@
+name: "Publish every Git push to main to FlakeHub"
+
+on:
+  push:
+    branches:
+      - "main"
+
+jobs:
+  flakehub-publish:
+    runs-on: "ubuntu-latest"
+    permissions:
+      id-token: "write"
+      contents: "read"
+    steps:
+      - uses: "actions/checkout@v4"
+      - uses: "DeterminateSystems/nix-installer-action@main"
+      - uses: "DeterminateSystems/flakehub-push@main"
+        with:
+          name: "DeterminateSystems/magic-nix-cache"
+          rolling: true
+          visibility: "public"

.github/workflows/keygen.yaml

@@ -5,10 +5,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - uses: DeterminateSystems/flakehub-cache-action@main
       - name: Expose GitHub Runtime
         uses: crazy-max/ghaction-github-runtime@v2
       - name: Dump credentials

.github/workflows/release-branches.yml

@@ -22,7 +22,7 @@ jobs:
       id-token: write # In order to request a JWT for AWS auth
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
         with:
@@ -32,28 +32,28 @@ jobs:
       - name: Create the artifacts directory
         run: rm -rf ./artifacts && mkdir ./artifacts
 
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4.1.8
         with:
           name: magic-nix-cache-ARM64-macOS
           path: cache-binary-ARM64-macOS
       - name: Persist the cache binary
         run: cp ./cache-binary-ARM64-macOS/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-ARM64-macOS
 
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4.1.8
         with:
           name: magic-nix-cache-X64-macOS
           path: cache-binary-X64-macOS
       - name: Persist the cache binary
         run: cp ./cache-binary-X64-macOS/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-X64-macOS
 
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4.1.8
         with:
           name: magic-nix-cache-X64-Linux
           path: cache-binary-X64-Linux
       - name: Persist the cache binary
         run: cp ./cache-binary-X64-Linux/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-X64-Linux
 
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4.1.8
         with:
           name: magic-nix-cache-ARM64-Linux
           path: cache-binary-ARM64-Linux

.github/workflows/release-prs.yml

@@ -10,13 +10,7 @@ on:
 
 jobs:
   build:
-    uses: ./.github/workflows/build.yaml
-    secrets: inherit
-
-  release:
-    needs: build
-
-    concurrency: release
+    # We want to build artifacts only if the `upload to s3` label is applied
     # Only intra-repo PRs are allowed to have PR artifacts uploaded
     # We only want to trigger once the upload once in the case the upload label is added, not when any label is added
     if: |
@@ -25,39 +19,45 @@ jobs:
         (github.event.action == 'labeled' && github.event.label.name == 'upload to s3')
         || (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'upload to s3'))
       )
+    uses: ./.github/workflows/build.yaml
+    secrets: inherit
+
+  release:
+    needs: build
+    concurrency: release
     runs-on: ubuntu-latest
     permissions:
       id-token: write # In order to request a JWT for AWS auth
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Create the artifacts directory
         run: rm -rf ./artifacts && mkdir ./artifacts
 
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4.1.8
         with:
           name: magic-nix-cache-ARM64-macOS
           path: cache-binary-ARM64-macOS
       - name: Persist the cache binary
         run: cp ./cache-binary-ARM64-macOS/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-ARM64-macOS
 
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4.1.8
         with:
           name: magic-nix-cache-X64-macOS
           path: cache-binary-X64-macOS
       - name: Persist the cache binary
         run: cp ./cache-binary-X64-macOS/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-X64-macOS
 
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4.1.8
         with:
           name: magic-nix-cache-X64-Linux
           path: cache-binary-X64-Linux
       - name: Persist the cache binary
         run: cp ./cache-binary-X64-Linux/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-X64-Linux
 
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4.1.8
         with:
           name: magic-nix-cache-ARM64-Linux
           path: cache-binary-ARM64-Linux

.github/workflows/release-tags.yml

@@ -19,33 +19,33 @@ jobs:
       id-token: write # In order to request a JWT for AWS auth
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Create the artifacts directory
         run: rm -rf ./artifacts && mkdir ./artifacts
 
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4.1.8
         with:
           name: magic-nix-cache-ARM64-macOS
           path: cache-binary-ARM64-macOS
       - name: Persist the cache binary
         run: cp ./cache-binary-ARM64-macOS/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-ARM64-macOS
 
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4.1.8
         with:
           name: magic-nix-cache-X64-macOS
           path: cache-binary-X64-macOS
       - name: Persist the cache binary
         run: cp ./cache-binary-X64-macOS/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-X64-macOS
 
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4.1.8
         with:
           name: magic-nix-cache-X64-Linux
           path: cache-binary-X64-Linux
       - name: Persist the cache binary
         run: cp ./cache-binary-X64-Linux/magic-nix-cache.closure.xz ./artifacts/magic-nix-cache-X64-Linux
 
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4.1.8
         with:
           name: magic-nix-cache-ARM64-Linux
           path: cache-binary-ARM64-Linux

.github/workflows/update-flake-lock.yaml

@@ -0,0 +1,20 @@
+name: update-flake-lock
+
+on:
+  workflow_dispatch: # enable manual triggering
+  schedule:
+    - cron: "0 0 * * 0" # every Sunday at midnight
+
+jobs:
+  lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/flakehub-cache-action@main
+      - uses: DeterminateSystems/update-flake-lock@main
+        with:
+          pr-title: Update flake.lock
+          pr-labels: |
+            dependencies
+            automated

README.md

@@ -1,5 +1,12 @@
 # Magic Nix Cache
 
+> [!WARNING]
+> The [Magic Nix Cache will will stop working](https://determinate.systems/posts/magic-nix-cache-free-tier-eol) on **February 1st, 2025** unless you're on [GitHub Enterprise Server](https://github.com/enterprise).
+>
+> You can upgrade to [FlakeHub Cache](https://flakehub.com/cache) and get **one month free** using the coupon code **`FHC`**.
+>
+> For more information, read [this blog post](https://determinate.systems/posts/magic-nix-cache-free-tier-eol/).
+
 Save 30-50%+ of CI time without any effort or cost.
 Use Magic Nix Cache, a totally free and zero-configuration binary cache for Nix on GitHub Actions.
 
@@ -10,7 +17,7 @@ permissions:
   contents: read
   id-token: write
 steps:
-  - uses: actions/checkout@v3
+  - uses: actions/checkout@v4
   - uses: DeterminateSystems/nix-installer-action@main
   - uses: DeterminateSystems/magic-nix-cache-action@main
   - run: nix flake check
@@ -52,7 +59,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
       - run: nix flake check
@@ -84,8 +91,8 @@ For local development, see `gha-cache/README.md` for more details on how to obta
 
 ```shell
 cargo run -- -c creds.json --upstream https://cache.nixos.org
-cargo build --release --target x86_64-unknown-linux-musl
-cargo build --release --target aarch64-unknown-linux-musl
+cargo build --release --target x86_64-unknown-linux-gnu
+cargo build --release --target aarch64-unknown-linux-gnu
 nix copy --to 'http://127.0.0.1:3000' $(which bash)
 nix-store --store $PWD/test-root --extra-substituters 'http://localhost:3000' --option require-sigs false -r $(which bash)
 ```

crane.nix

@@ -1,122 +0,0 @@
-{ stdenv
-, pkgs
-, lib
-, crane
-, rust
-, rust-bin
-, nix-gitignore
-, supportedSystems
-, nix-flake
-}:
-
-let
-  inherit (stdenv.hostPlatform) system;
-
-  nightlyVersion = "2024-03-28";
-  rustNightly = (pkgs.rust-bin.nightly.${nightlyVersion}.default.override {
-    extensions = [ "rust-src" "rust-analyzer-preview" ];
-    targets = cargoTargets;
-  }).overrideAttrs (old: {
-    # Remove the propagated libiconv since we want to add our static version
-    depsTargetTargetPropagated = lib.filter (d: d.pname != "libiconv")
-      (lib.flatten (old.depsTargetTargetPropagated or [ ]));
-  });
-
-  # For easy cross-compilation in devShells
-  # We are just composing the pkgsCross.*.stdenv.cc together
-  crossPlatforms =
-    let
-      makeCrossPlatform = crossSystem:
-        let
-          pkgsCross =
-            if crossSystem == system then pkgs
-            else
-              import pkgs.path {
-                inherit system crossSystem;
-                overlays = [ nix-flake.overlays.default ];
-              };
-
-          rustTargetSpec = rust.toRustTargetSpec pkgsCross.pkgsStatic.stdenv.hostPlatform;
-          rustTargetSpecUnderscored = builtins.replaceStrings [ "-" ] [ "_" ] rustTargetSpec;
-
-          cargoLinkerEnv = lib.strings.toUpper "CARGO_TARGET_${rustTargetSpecUnderscored}_LINKER";
-          cargoCcEnv = "CC_${rustTargetSpecUnderscored}"; # for ring
-
-          ccbin = "${pkgsCross.stdenv.cc}/bin/${pkgsCross.stdenv.cc.targetPrefix}cc";
-        in
-        {
-          name = crossSystem;
-          value = {
-            inherit rustTargetSpec;
-            cc = pkgsCross.stdenv.cc;
-            pkgs = pkgsCross;
-            buildInputs = makeBuildInputs pkgsCross;
-            env = {
-              "${cargoLinkerEnv}" = ccbin;
-              "${cargoCcEnv}" = ccbin;
-            };
-          };
-        };
-      systems = lib.filter (s: s == system || lib.hasInfix "linux" s) supportedSystems
-        # Cross from aarch64-darwin -> x86_64-darwin doesn't work yet
-        # Hopefully the situation will improve with the SDK bumps
-        ++ lib.optional (system == "x86_64-darwin") "aarch64-darwin";
-    in
-    builtins.listToAttrs (map makeCrossPlatform systems);
-
-  cargoTargets = lib.mapAttrsToList (_: p: p.rustTargetSpec) crossPlatforms;
-  cargoCrossEnvs = lib.foldl (acc: p: acc // p.env) { } (builtins.attrValues crossPlatforms);
-
-  makeBuildInputs = pkgs:
-    [ pkgs.nix
-      pkgs.boost # needed for clippy
-    ]
-    ++ lib.optionals pkgs.stdenv.isDarwin [
-    pkgs.darwin.apple_sdk.frameworks.Security
-    (pkgs.libiconv.override { enableStatic = true; enableShared = false; })
-  ];
-
-  buildFor = system:
-    let
-      crossPlatform = crossPlatforms.${system};
-      inherit (crossPlatform) pkgs;
-      craneLib = (crane.mkLib pkgs).overrideToolchain rustNightly;
-      crateName = craneLib.crateNameFromCargoToml {
-        cargoToml = ./magic-nix-cache/Cargo.toml;
-      };
-
-      src = nix-gitignore.gitignoreSource [ ] ./.;
-
-      commonArgs = {
-        inherit (crateName) pname version;
-        inherit src;
-
-        nativeBuildInputs = [ pkgs.pkg-config ];
-
-        buildInputs = makeBuildInputs pkgs;
-
-        cargoExtraArgs = "--target ${crossPlatform.rustTargetSpec}";
-
-        cargoVendorDir = craneLib.vendorMultipleCargoDeps {
-          inherit (craneLib.findCargoFiles src) cargoConfigs;
-          cargoLockList = [
-            ./Cargo.lock
-            "${rustNightly.passthru.availableComponents.rust-src}/lib/rustlib/src/rust/Cargo.lock"
-          ];
-        };
-      } // crossPlatform.env;
-
-      crate = craneLib.buildPackage (commonArgs // {
-        cargoArtifacts = craneLib.buildDepsOnly commonArgs;
-
-        # The resulting executable must be standalone
-        allowedRequisites = [ ];
-      });
-    in
-    crate;
-in
-{
-  inherit crossPlatforms cargoTargets cargoCrossEnvs rustNightly;
-
-  magic-nix-cache = buildFor system;
-}

flake.lock

@@ -1,124 +1,141 @@
 {
   "nodes": {
     "crane": {
+      "locked": {
+        "lastModified": 1741479724,
+        "narHash": "sha256-fnyETBKSVRa5abjOiRG/IAzKZq5yX8U6oRrHstPl4VM=",
+        "rev": "60202a2e3597a3d91f5e791aab03f45470a738b5",
+        "revCount": 709,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/ipetkov/crane/0.20.2/0195784b-915b-7d2d-915d-ab02d1112ef9/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/ipetkov/crane/%2A"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-parts": {
       "inputs": {
-        "nixpkgs": [
+        "nixpkgs-lib": [
+          "nix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1710886643,
-        "narHash": "sha256-saTZuv9YeZ9COHPuj8oedGdUwJZcbQ3vyRqe7NVJMsQ=",
-        "rev": "5bace74e9a65165c918205cf67ad3977fe79c584",
-        "revCount": 525,
-        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/ipetkov/crane/0.16.3/018e58cb-e73a-767a-a419-c5d172da29bb/source.tar.gz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://flakehub.com/f/ipetkov/crane/0.16.3.tar.gz"
-      }
-    },
-    "flake-compat": {
-      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
-        "revCount": 57,
-        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.0.1/018afb31-abd1-7bff-a5e4-cff7e18efb7a/source.tar.gz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://flakehub.com/f/edolstra/flake-compat/1.0.1.tar.gz"
-      }
-    },
-    "flake-compat_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1673956053,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
         "type": "github"
       },
       "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
         "type": "github"
       }
     },
-    "flake-utils": {
+    "git-hooks-nix": {
       "inputs": {
-        "systems": "systems"
+        "flake-compat": [
+          "nix"
+        ],
+        "gitignore": [
+          "nix"
+        ],
+        "nixpkgs": [
+          "nix",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": [
+          "nix",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1705309234,
-        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+        "lastModified": 1734279981,
+        "narHash": "sha256-NdaCraHPp8iYMWzdXAt5Nv6sA3MUzlCiGiR586TCwo0=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "aa9f40c906904ebd83da78e7f328cd8aeaeae785",
         "type": "github"
       },
       "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "libgit2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1697646580,
-        "narHash": "sha256-oX4Z3S9WtJlwvj0uH9HlYcWv+x1hqp8mhXl7HsLu2f0=",
-        "owner": "libgit2",
-        "repo": "libgit2",
-        "rev": "45fd9ed7ae1a9b74b957ef4f337bc3c8b3df01b5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "libgit2",
-        "repo": "libgit2",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
         "type": "github"
       }
     },
     "nix": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
-        "libgit2": "libgit2",
+        "flake-compat": "flake-compat",
+        "flake-parts": "flake-parts",
+        "git-hooks-nix": "git-hooks-nix",
         "nixpkgs": "nixpkgs",
+        "nixpkgs-23-11": "nixpkgs-23-11",
         "nixpkgs-regression": "nixpkgs-regression"
       },
       "locked": {
-        "lastModified": 1711461841,
-        "narHash": "sha256-iRtvOcJbohyhav+deEajI/Ln/LU/6WqSfLyXDQaNEro=",
-        "rev": "3272ed0d5813175ea240ce2dfadf9de24c9d14ae",
-        "revCount": 16479,
+        "lastModified": 1742824067,
+        "narHash": "sha256-rBPulEBpn4IiqkPsetuh7BRzT2iGCzZYnogTAsbrvhU=",
+        "rev": "9cb662df7442a1e2c4600fb8ecb2ad613ebc5a95",
+        "revCount": 19496,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/NixOS/nix/2.21.1/018e7be9-60f2-7fe1-9c78-96dd0769050f/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nix/2.27.1/0195c8c5-1964-7a31-b025-ebf9bfeef991/source.tar.gz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://flakehub.com/f/NixOS/nix/2.20.tar.gz"
+        "url": "https://flakehub.com/f/NixOS/nix/2"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1709083642,
-        "narHash": "sha256-7kkJQd4rZ+vFrzWu8sTRtta5D1kBG0LSRYAfhtmMlSo=",
+        "lastModified": 1734359947,
+        "narHash": "sha256-1Noao/H+N8nFB4Beoy8fgwrcOQLVm9o4zKW1ODaqK9E=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b550fe4b4776908ac2a861124307045f8e717c8e",
+        "rev": "48d12d5e70ee91fe8481378e540433a7303dbf6a",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "release-23.11",
+        "ref": "release-24.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
+    "nixpkgs-23-11": {
+      "locked": {
+        "lastModified": 1717159533,
+        "narHash": "sha256-oamiKNfr2MS6yH64rUn99mIZjc45nGJlj9eGth/3Xuw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
+        "type": "github"
+      }
+    },
     "nixpkgs-regression": {
       "locked": {
         "lastModified": 1643052045,
@@ -137,61 +154,23 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1711460390,
-        "narHash": "sha256-akSgjDZL6pVHEfSE6sz1DNSXuYX6hq+P/1Z5IoYWs7E=",
-        "rev": "44733514b72e732bd49f5511bd0203dea9b9a434",
-        "revCount": 557010,
+        "lastModified": 1742422364,
+        "narHash": "sha256-mNqIplmEohk5jRkqYqG19GA8MbQ/D4gQSK0Mu4LvfRQ=",
+        "rev": "a84ebe20c6bc2ecbcfb000a50776219f48d134cc",
+        "revCount": 770807,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2311.557010%2Brev-44733514b72e732bd49f5511bd0203dea9b9a434/018e7fb1-6425-7bf8-9105-2e6dcdc10701/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.770807%2Brev-a84ebe20c6bc2ecbcfb000a50776219f48d134cc/0195b626-8c1d-7fb9-9282-563af3d37ab9/source.tar.gz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://flakehub.com/f/NixOS/nixpkgs/0.2311.tar.gz"
+        "url": "https://flakehub.com/f/NixOS/nixpkgs/0.1"
       }
     },
     "root": {
       "inputs": {
         "crane": "crane",
-        "flake-compat": "flake-compat",
         "nix": "nix",
-        "nixpkgs": "nixpkgs_2",
-        "rust-overlay": "rust-overlay"
-      }
-    },
-    "rust-overlay": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1711678273,
-        "narHash": "sha256-7lIB0hMRnfzx/9oSIwTnwXmVnbvVGRoadOCW+1HI5zY=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "42a168449605950935f15ea546f6f770e5f7f629",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
+        "nixpkgs": "nixpkgs_2"
       }
     }
   },

flake.nix

@@ -2,160 +2,123 @@
   description = "GitHub Actions-powered Nix binary cache";
 
   inputs = {
-    nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.2311.tar.gz";
+    nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.1";
 
-    rust-overlay = {
-      url = "github:oxalica/rust-overlay";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    crane.url = "https://flakehub.com/f/ipetkov/crane/*";
 
-    crane = {
-      url = "https://flakehub.com/f/ipetkov/crane/0.16.3.tar.gz";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    flake-compat.url = "https://flakehub.com/f/edolstra/flake-compat/1.0.1.tar.gz";
-
-    nix.url = "https://flakehub.com/f/NixOS/nix/2.20.tar.gz";
+    nix.url = "https://flakehub.com/f/NixOS/nix/2";
   };
 
-  outputs = { self, nixpkgs, nix, ... }@inputs:
+  outputs = inputs:
     let
-      overlays = [ inputs.rust-overlay.overlays.default nix.overlays.default ];
       supportedSystems = [
         "aarch64-linux"
         "x86_64-linux"
         "aarch64-darwin"
         "x86_64-darwin"
       ];
-      forEachSupportedSystem = f: nixpkgs.lib.genAttrs supportedSystems (system: f rec {
-        pkgs = import nixpkgs { inherit overlays system; };
-        cranePkgs = pkgs.callPackage ./crane.nix {
-          inherit supportedSystems;
-          inherit (inputs) crane;
-          nix-flake = nix;
+
+      forEachSupportedSystem = f: inputs.nixpkgs.lib.genAttrs supportedSystems (system: f rec {
+        pkgs = import inputs.nixpkgs {
+          inherit system;
+          overlays = [
+            inputs.self.overlays.default
+          ];
         };
-        inherit (pkgs) lib;
+        inherit system;
       });
     in
     {
-      packages = forEachSupportedSystem ({ pkgs, cranePkgs, ... }: rec {
-        magic-nix-cache = pkgs.callPackage ./package.nix { };
-        #inherit (cranePkgs) magic-nix-cache;
+
+      overlays.default = final: prev:
+      let
+          craneLib = inputs.crane.mkLib final;
+          crateName = craneLib.crateNameFromCargoToml {
+            cargoToml = ./magic-nix-cache/Cargo.toml;
+          };
+
+          commonArgs = {
+            inherit (crateName) pname version;
+            src = inputs.self;
+
+            nativeBuildInputs = with final; [
+              pkg-config
+            ];
+
+            buildInputs = [
+              inputs.nix.packages.${final.stdenv.system}.default
+              final.boost
+            ];
+          };
+
+          cargoArtifacts = craneLib.buildDepsOnly commonArgs;
+      in
+      {
+        magic-nix-cache = craneLib.buildPackage (commonArgs // {
+          inherit cargoArtifacts;
+        });
+      };
+
+      packages = forEachSupportedSystem ({ pkgs, ... }: rec {
+        magic-nix-cache = pkgs.magic-nix-cache;
         default = magic-nix-cache;
+
+        veryLongChain =
+          let
+            ctx = ./README.md;
+
+            # Function to write the current date to a file
+            startFile =
+              pkgs.stdenv.mkDerivation {
+                name = "start-file";
+                buildCommand = ''
+                  cat ${ctx} > $out
+                '';
+              };
+
+            # Recursive function to create a chain of derivations
+            createChain = n: startFile:
+              pkgs.stdenv.mkDerivation {
+                name = "chain-${toString n}";
+                src =
+                  if n == 0 then
+                    startFile
+                  else createChain (n - 1) startFile;
+                buildCommand = ''
+                  echo $src  > $out
+                '';
+              };
+
+          in
+          # Starting point of the chain
+          createChain 200 startFile;
       });
 
-      devShells = forEachSupportedSystem ({ pkgs, cranePkgs, lib }: {
+      devShells = forEachSupportedSystem ({ system, pkgs }: {
         default = pkgs.mkShell {
-          inputsFrom = [ cranePkgs.magic-nix-cache ];
           packages = with pkgs; [
+            rustc
+            cargo
+            clippy
+            rustfmt
+            rust-analyzer
+
+            inputs.nix.packages.${stdenv.system}.default # for linking attic
+            boost # for linking attic
             bashInteractive
-            cranePkgs.rustNightly
+            pkg-config
 
             cargo-bloat
             cargo-edit
             cargo-udeps
             cargo-watch
+            bacon
 
             age
           ];
+
+          RUST_SRC_PATH = "${pkgs.rustPlatform.rustcSrc}/library";
         };
-
-        /*
-        cross = pkgs.mkShell ({
-          inputsFrom = [ cranePkgs.magic-nix-cache ];
-          packages = with pkgs; [
-            bashInteractive
-            cranePkgs.rustNightly
-
-            cargo-bloat
-            cargo-edit
-            cargo-udeps
-            cargo-watch
-
-            age
-          ];
-          shellHook =
-            let
-              crossSystems = lib.filter (s: s != pkgs.system) (builtins.attrNames cranePkgs.crossPlatforms);
-            in
-            ''
-              # Returns compiler environment variables for a platform
-              #
-              # getTargetFlags "suffixSalt" "nativeBuildInputs" "buildInputs"
-              getTargetFlags() {
-                # Here we only call the setup-hooks of nativeBuildInputs.
-                #
-                # What's off-limits for us:
-                #
-                # - findInputs
-                # - activatePackage
-                # - Other functions in stdenv setup that depend on the private accumulator variables
-                (
-                  suffixSalt="$1"
-                  nativeBuildInputs="$2"
-                  buildInputs="$3"
-
-                  # Offsets for the nativeBuildInput (e.g., gcc)
-                  hostOffset=-1
-                  targetOffset=0
-
-                  # In stdenv, the hooks are first accumulated before being called.
-                  # Here we call them immediately
-                  addEnvHooks() {
-                    local depHostOffset="$1"
-                    # For simplicity, we only call the hook on buildInputs
-                    for pkg in $buildInputs; do
-                      depTargetOffset=1
-                      $2 $pkg
-                    done
-                  }
-
-                  unset _PATH
-                  unset NIX_CFLAGS_COMPILE
-                  unset NIX_LDFLAGS
-
-                  # For simplicity, we only call the setup-hooks of nativeBuildInputs
-                  for nbi in $nativeBuildInputs; do
-                    addToSearchPath _PATH "$nbi/bin"
-
-                    if [ -e "$nbi/nix-support/setup-hook" ]; then
-                      source "$nbi/nix-support/setup-hook"
-                    fi
-                  done
-
-                  echo "export NIX_CFLAGS_COMPILE_''${suffixSalt}='$NIX_CFLAGS_COMPILE'"
-                  echo "export NIX_LDFLAGS_''${suffixSalt}='$NIX_LDFLAGS'"
-                  echo "export PATH=$PATH''${_PATH+:$_PATH}"
-                )
-              }
-
-              target_flags=$(mktemp)
-              ${lib.concatMapStrings (system: let
-                crossPlatform = cranePkgs.crossPlatforms.${system};
-              in ''
-                getTargetFlags \
-                  "${crossPlatform.cc.suffixSalt}" \
-                  "${crossPlatform.cc} ${crossPlatform.cc.bintools}" \
-                  "${builtins.concatStringsSep " " (crossPlatform.buildInputs ++ crossPlatform.pkgs.stdenv.defaultBuildInputs)}" >$target_flags
-                . $target_flags
-              '') crossSystems}
-              rm $target_flags
-
-              # Suffix flags for current system as well
-              export NIX_CFLAGS_COMPILE_${pkgs.stdenv.cc.suffixSalt}="$NIX_CFLAGS_COMPILE"
-              export NIX_LDFLAGS_${pkgs.stdenv.cc.suffixSalt}="$NIX_LDFLAGS"
-              unset NIX_CFLAGS_COMPILE
-              unset NIX_LDFLAGS
-            '';
-        } // cranePkgs.cargoCrossEnvs);
-
-        keygen = pkgs.mkShellNoCC {
-          packages = with pkgs; [
-            age
-          ];
-        };
-        */
       });
     };
 }

gha-cache/Cargo.toml

@@ -11,12 +11,12 @@ derivative = { version = "2.2.0", default-features = false }
 futures = { version = "0.3.28", default-features = false, features = ["alloc"] }
 hex = "0.4.3"
 rand = { version = "0.8.5", default-features = false, features = ["std", "std_rng"] }
-reqwest = { version = "0.11.17", default-features = false, features = ["json", "rustls-tls-native-roots", "stream", "trust-dns"] }
+reqwest = { version = "0.12.5", default-features = false, features = ["json", "rustls-tls-native-roots", "stream", "trust-dns"] }
 serde = { version = "1.0.162", default-features = false, features = ["derive"] }
 serde_json = { version = "1.0.96", default-features = false }
 sha2 = { version = "0.10.6", default-features = false }
 thiserror = "1.0.40"
-tokio = { version = "1.28.0", default-features = false, features = ["io-util"] }
+tokio = { version = "1.44.2", default-features = false, features = ["io-util"] }
 tracing = { version = "0.1.37", default-features = false }
 unicode-bom = "2.0.2"
 

gha-cache/src/api.rs

@@ -4,7 +4,8 @@
 
 use std::fmt;
 #[cfg(debug_assertions)]
-use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::atomic::AtomicUsize;
+use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::Arc;
 
 use async_trait::async_trait;
@@ -47,12 +48,19 @@ const MAX_CONCURRENCY: usize = 4;
 
 type Result<T> = std::result::Result<T, Error>;
 
+pub type CircuitBreakerTrippedCallback = Arc<Box<dyn Fn() + Send + Sync>>;
+
 /// An API error.
 #[derive(Error, Debug)]
 pub enum Error {
     #[error("Failed to initialize the client: {0}")]
     InitError(Box<dyn std::error::Error + Send + Sync>),
 
+    #[error(
+        "GitHub Actions Cache throttled Magic Nix Cache. Not trying to use it again on this run."
+    )]
+    CircuitBreakerTripped,
+
     #[error("Request error: {0}")]
     RequestError(#[from] reqwest::Error), // TODO: Better errors
 
@@ -69,14 +77,13 @@ pub enum Error {
         info: ApiErrorInfo,
     },
 
-    #[error("I/O error: {0}")]
-    IoError(#[from] std::io::Error),
+    #[error("I/O error: {0}, context: {1}")]
+    IoError(std::io::Error, String),
 
     #[error("Too many collisions")]
     TooManyCollisions,
 }
 
-#[derive(Debug)]
 pub struct Api {
     /// Credentials to access the cache.
     credentials: Credentials,
@@ -96,6 +103,10 @@ pub struct Api {
     /// The concurrent upload limit.
     concurrency_limit: Arc<Semaphore>,
 
+    circuit_breaker_429_tripped: Arc<AtomicBool>,
+
+    circuit_breaker_429_tripped_callback: CircuitBreakerTrippedCallback,
+
     /// Backend request statistics.
     #[cfg(debug_assertions)]
     stats: RequestStats,
@@ -108,7 +119,7 @@ pub struct FileAllocation(CacheId);
 /// The ID of a cache.
 #[derive(Debug, Clone, Copy, Serialize, Deserialize)]
 #[serde(transparent)]
-struct CacheId(pub i32);
+struct CacheId(pub i64);
 
 /// An API error.
 #[derive(Debug, Clone)]
@@ -234,7 +245,10 @@ impl fmt::Display for ApiErrorInfo {
 }
 
 impl Api {
-    pub fn new(credentials: Credentials) -> Result<Self> {
+    pub fn new(
+        credentials: Credentials,
+        circuit_breaker_429_tripped_callback: CircuitBreakerTrippedCallback,
+    ) -> Result<Self> {
         let mut headers = HeaderMap::new();
         let auth_header = {
             let mut h = HeaderValue::from_str(&format!("Bearer {}", credentials.runtime_token))
@@ -264,11 +278,17 @@ impl Api {
             version_hasher,
             client,
             concurrency_limit: Arc::new(Semaphore::new(MAX_CONCURRENCY)),
+            circuit_breaker_429_tripped: Arc::new(AtomicBool::from(false)),
+            circuit_breaker_429_tripped_callback,
             #[cfg(debug_assertions)]
             stats: Default::default(),
         })
     }
 
+    pub fn circuit_breaker_tripped(&self) -> bool {
+        self.circuit_breaker_429_tripped.load(Ordering::Relaxed)
+    }
+
     /// Mutates the cache version/namespace.
     pub fn mutate_version(&mut self, data: &[u8]) {
         self.version_hasher.update(data);
@@ -324,12 +344,17 @@ impl Api {
     where
         S: AsyncRead + Unpin + Send,
     {
+        if self.circuit_breaker_tripped() {
+            return Err(Error::CircuitBreakerTripped);
+        }
+
         let mut offset = 0;
         let mut futures = Vec::new();
         loop {
             let buf = BytesMut::with_capacity(CHUNK_SIZE);
-            let chunk = read_chunk_async(&mut stream, buf).await?;
-
+            let chunk = read_chunk_async(&mut stream, buf)
+                .await
+                .map_err(|e| Error::IoError(e, "Reading a chunk during upload".to_string()))?;
             if chunk.is_empty() {
                 offset += chunk.len();
                 break;
@@ -347,10 +372,16 @@ impl Api {
             futures.push({
                 let client = self.client.clone();
                 let concurrency_limit = self.concurrency_limit.clone();
+                let circuit_breaker_429_tripped = self.circuit_breaker_429_tripped.clone();
+                let circuit_breaker_429_tripped_callback =
+                    self.circuit_breaker_429_tripped_callback.clone();
                 let url = self.construct_url(&format!("caches/{}", allocation.0 .0));
 
                 tokio::task::spawn(async move {
-                    let permit = concurrency_limit.acquire().await.unwrap();
+                    let permit = concurrency_limit
+                        .acquire()
+                        .await
+                        .expect("failed to acquire concurrency semaphore permit");
 
                     tracing::trace!(
                         "Starting uploading chunk {}-{}",
@@ -380,6 +411,9 @@ impl Api {
 
                     drop(permit);
 
+                    circuit_breaker_429_tripped
+                        .check_result(&r, &circuit_breaker_429_tripped_callback);
+
                     r
                 })
             });
@@ -390,7 +424,9 @@ impl Api {
         future::join_all(futures)
             .await
             .into_iter()
-            .try_for_each(|join_result| join_result.unwrap())?;
+            .try_for_each(|join_result| {
+                join_result.expect("failed collecting a join result during parallel upload")
+            })?;
 
         tracing::debug!("Received all chunks for cache {:?}", allocation.0);
 
@@ -401,6 +437,10 @@ impl Api {
 
     /// Downloads a file based on a list of key prefixes.
     pub async fn get_file_url(&self, keys: &[&str]) -> Result<Option<String>> {
+        if self.circuit_breaker_tripped() {
+            return Err(Error::CircuitBreakerTripped);
+        }
+
         Ok(self
             .get_cache_entry(keys)
             .await?
@@ -419,6 +459,10 @@ impl Api {
 
     /// Retrieves a cache based on a list of key prefixes.
     async fn get_cache_entry(&self, keys: &[&str]) -> Result<Option<ArtifactCacheEntry>> {
+        if self.circuit_breaker_tripped() {
+            return Err(Error::CircuitBreakerTripped);
+        }
+
         #[cfg(debug_assertions)]
         self.stats.get.fetch_add(1, Ordering::SeqCst);
 
@@ -431,6 +475,9 @@ impl Api {
             .check_json()
             .await;
 
+        self.circuit_breaker_429_tripped
+            .check_result(&res, &self.circuit_breaker_429_tripped_callback);
+
         match res {
             Ok(entry) => Ok(Some(entry)),
             Err(Error::DecodeError { status, .. }) if status == StatusCode::NO_CONTENT => Ok(None),
@@ -448,6 +495,10 @@ impl Api {
         key: &str,
         cache_size: Option<usize>,
     ) -> Result<ReserveCacheResponse> {
+        if self.circuit_breaker_tripped() {
+            return Err(Error::CircuitBreakerTripped);
+        }
+
         tracing::debug!("Reserving cache for {}", key);
 
         let req = ReserveCacheRequest {
@@ -466,13 +517,20 @@ impl Api {
             .send()
             .await?
             .check_json()
-            .await?;
+            .await;
 
-        Ok(res)
+        self.circuit_breaker_429_tripped
+            .check_result(&res, &self.circuit_breaker_429_tripped_callback);
+
+        res
     }
 
     /// Finalizes uploading to a cache.
     async fn commit_cache(&self, cache_id: CacheId, size: usize) -> Result<()> {
+        if self.circuit_breaker_tripped() {
+            return Err(Error::CircuitBreakerTripped);
+        }
+
         tracing::debug!("Commiting cache {:?}", cache_id);
 
         let req = CommitCacheRequest { size };
@@ -480,22 +538,31 @@ impl Api {
         #[cfg(debug_assertions)]
         self.stats.post.fetch_add(1, Ordering::SeqCst);
 
-        self.client
+        if let Err(e) = self
+            .client
             .post(self.construct_url(&format!("caches/{}", cache_id.0)))
             .json(&req)
             .send()
             .await?
             .check()
-            .await?;
+            .await
+        {
+            self.circuit_breaker_429_tripped
+                .check_err(&e, &self.circuit_breaker_429_tripped_callback);
+            return Err(e);
+        }
 
         Ok(())
     }
 
     fn construct_url(&self, resource: &str) -> String {
-        format!(
-            "{}/_apis/artifactcache/{}",
-            self.credentials.cache_url, resource
-        )
+        let mut url = self.credentials.cache_url.clone();
+        if !url.ends_with('/') {
+            url.push('/');
+        }
+        url.push_str("_apis/artifactcache/");
+        url.push_str(resource);
+        url
     }
 }
 
@@ -554,3 +621,36 @@ async fn handle_error(res: reqwest::Response) -> Error {
 
     Error::ApiError { status, info }
 }
+
+trait AtomicCircuitBreaker {
+    fn check_err(&self, e: &Error, callback: &CircuitBreakerTrippedCallback);
+    fn check_result<T>(
+        &self,
+        r: &std::result::Result<T, Error>,
+        callback: &CircuitBreakerTrippedCallback,
+    );
+}
+
+impl AtomicCircuitBreaker for AtomicBool {
+    fn check_result<T>(
+        &self,
+        r: &std::result::Result<T, Error>,
+        callback: &CircuitBreakerTrippedCallback,
+    ) {
+        if let Err(ref e) = r {
+            self.check_err(e, callback)
+        }
+    }
+
+    fn check_err(&self, e: &Error, callback: &CircuitBreakerTrippedCallback) {
+        if let Error::ApiError {
+            status: reqwest::StatusCode::TOO_MANY_REQUESTS,
+            ..
+        } = e
+        {
+            tracing::info!("Disabling GitHub Actions Cache due to 429: Too Many Requests");
+            self.store(true, Ordering::Relaxed);
+            callback();
+        }
+    }
+}

magic-nix-cache/Cargo.toml

@@ -7,21 +7,41 @@ license = "Apache-2.0"
 [dependencies]
 gha-cache = { path = "../gha-cache" }
 
-axum = { version = "0.6.18", default-features = false, features = ["json", "tokio"] }
-axum-macros = "0.3.7"
-clap = { version = "4.2.7", default-features = false, features = ["std", "derive", "error-context", "wrap_help"] }
+axum = { version = "0.7.5", default-features = false, features = [
+	"json",
+	"tokio",
+	"http2",
+	"macros"
+] }
+clap = { version = "4.2.7", default-features = false, features = [
+	"std",
+	"derive",
+	"error-context",
+	"wrap_help",
+] }
 tracing = "0.1.37"
-tracing-subscriber = { version = "0.3.17", default-features = false, features = ["ansi", "env-filter", "fmt", "tracing-log", "smallvec"] }
-tower-http = { version = "0.4.0", features = ["trace"] }
+tracing-subscriber = { version = "0.3.17", default-features = false, features = [
+	"ansi",
+	"env-filter",
+	"fmt",
+	"tracing-log",
+	"smallvec",
+] }
+tower-http = { version = "0.5.2", features = ["trace"] }
 serde = { version = "1.0.162", features = ["derive"] }
 serde_json = { version = "1.0.96", default-features = false }
 thiserror = "1.0.40"
-tokio-stream = { version = "0.1.14", default-features = false }
-tokio-util = { version = "0.7.8", features = ["io", "compat"] }
+tokio-stream = { version = "0.1.15", default-features = false }
+tokio-util = { version = "0.7.11", features = ["io", "compat"] }
 daemonize = "0.5.0"
 is_ci = "1.1.1"
 sha2 = { version = "0.10.6", default-features = false }
-reqwest = { version = "0.11.17", default-features = false, features = ["blocking", "rustls-tls-native-roots", "trust-dns"] }
+reqwest = { version = "0.12.5", default-features = false, features = [
+	"blocking",
+	"rustls-tls-native-roots",
+	"trust-dns",
+	"json"
+] }
 netrc-rs = "0.1.2"
 attic = { git = "https://github.com/DeterminateSystems/attic", branch = "fixups-for-magic-nix-cache" }
 attic-client = { git = "https://github.com/DeterminateSystems/attic", branch = "fixups-for-magic-nix-cache" }
@@ -32,15 +52,14 @@ tempfile = "3.9"
 uuid = { version = "1.4.0", features = ["serde", "v7", "rand", "std"] }
 futures = "0.3"
 async-compression = "0.4"
+tracing-appender = "0.2.3"
+http = "1.0"
+http-body-util = "0.1"
+hyper = { version = "1.0.0", features = ["full"] }
+hyper-util = { version = "0.1", features = ["tokio", "server-auto", "http1"] }
+xdg = { version = "2.5.2" }
 
 [dependencies.tokio]
-version = "1.28.0"
+version = "1.44.2"
 default-features = false
-features = [
-	"fs",
-	"macros",
-	"process",
-	"rt",
-	"rt-multi-thread",
-	"sync",
-]
+features = ["fs", "macros", "process", "rt", "rt-multi-thread", "sync"]

magic-nix-cache/src/api.rs

@@ -2,36 +2,53 @@
 //!
 //! This API is intended to be used by nix-installer-action.
 
+use attic::nix_store::StorePath;
 use axum::{extract::Extension, routing::post, Json, Router};
-use axum_macros::debug_handler;
 use serde::{Deserialize, Serialize};
 
 use super::State;
 use crate::error::{Error, Result};
 
 #[derive(Debug, Clone, Serialize)]
-struct WorkflowStartResponse {}
+struct WorkflowStartResponse {
+    num_original_paths: Option<usize>,
+}
 
 #[derive(Debug, Clone, Serialize)]
 struct WorkflowFinishResponse {
-    //num_new_paths: usize,
+    num_original_paths: Option<usize>,
+    num_final_paths: Option<usize>,
+    num_new_paths: Option<usize>,
 }
 
 pub fn get_router() -> Router {
     Router::new()
         .route("/api/workflow-start", post(workflow_start))
         .route("/api/workflow-finish", post(workflow_finish))
-        .route("/api/enqueue-paths", post(enqueue_paths))
+        .route("/api/enqueue-paths", post(post_enqueue_paths))
 }
 
 /// Record existing paths.
-#[debug_handler]
-async fn workflow_start(
-    Extension(_state): Extension<State>,
-) -> Result<Json<WorkflowStartResponse>> {
+async fn workflow_start(Extension(state): Extension<State>) -> Result<Json<WorkflowStartResponse>> {
     tracing::info!("Workflow started");
+    let reply = if let Some(original_paths) = &state.original_paths {
+        let mut original_paths = original_paths.lock().await;
+        *original_paths = crate::util::get_store_paths(&state.store).await?;
 
-    Ok(Json(WorkflowStartResponse {}))
+        let reply = WorkflowStartResponse {
+            num_original_paths: Some(original_paths.len()),
+        };
+
+        state.metrics.num_original_paths.set(original_paths.len());
+
+        reply
+    } else {
+        WorkflowStartResponse {
+            num_original_paths: None,
+        }
+    };
+
+    Ok(Json(reply))
 }
 
 /// Push new paths and shut down.
@@ -40,28 +57,74 @@ async fn workflow_finish(
 ) -> Result<Json<WorkflowFinishResponse>> {
     tracing::info!("Workflow finished");
 
+    let response = if let Some(original_paths) = &state.original_paths {
+        let original_paths = original_paths.lock().await;
+        let final_paths = crate::util::get_store_paths(&state.store).await?;
+        let new_paths = final_paths
+            .difference(&original_paths)
+            .cloned()
+            .map(|path| state.store.follow_store_path(path).map_err(Error::Attic))
+            .collect::<Result<Vec<_>>>()?;
+
+        let num_original_paths = original_paths.len();
+        let num_final_paths = final_paths.len();
+        let num_new_paths = new_paths.len();
+
+        let reply = WorkflowFinishResponse {
+            num_original_paths: Some(num_original_paths),
+            num_final_paths: Some(num_final_paths),
+            num_new_paths: Some(num_new_paths),
+        };
+
+        state.metrics.num_original_paths.set(num_original_paths);
+        state.metrics.num_final_paths.set(num_final_paths);
+        state.metrics.num_new_paths.set(num_new_paths);
+
+        // NOTE(cole-h): If we're substituting from an upstream cache, those paths won't have the
+        // post-build-hook run on it, so we diff the store to ensure we cache everything we can.
+        tracing::info!("Diffing the store and uploading any new paths before we shut down");
+        enqueue_paths(&state, new_paths).await?;
+
+        reply
+    } else {
+        WorkflowFinishResponse {
+            num_original_paths: None,
+            num_final_paths: None,
+            num_new_paths: None,
+        }
+    };
+
     if let Some(gha_cache) = &state.gha_cache {
         tracing::info!("Waiting for GitHub action cache uploads to finish");
         gha_cache.shutdown().await?;
     }
 
+    if let Some(attic_state) = state.flakehub_state.write().await.take() {
+        tracing::info!("Waiting for FlakeHub cache uploads to finish");
+        let paths = attic_state.push_session.wait().await?;
+
+        let paths = paths.keys().map(|s| s.name()).collect::<Vec<_>>();
+
+        tracing::info!(?paths, "FlakeHub Cache uploads completed");
+    } else {
+        tracing::info!("FlakeHub cache is not enabled, not uploading anything to it");
+    }
+
     if let Some(sender) = state.shutdown_sender.lock().await.take() {
         sender
             .send(())
             .map_err(|_| Error::Internal("Sending shutdown server message".to_owned()))?;
-
-        // Wait for the Attic push workers to finish.
-        if let Some(attic_state) = state.flakehub_state.write().await.take() {
-            tracing::info!("Waiting for FlakeHub cache uploads to finish");
-            attic_state.push_session.wait().await?;
-        }
     }
 
-    let reply = WorkflowFinishResponse {};
+    // NOTE(cole-h): see `init_logging`
+    if let Some(logfile) = &state.logfile {
+        let logfile_contents = std::fs::read_to_string(logfile)
+            .map_err(|e| crate::error::Error::Io(e, format!("Reading {}", logfile.display())))?;
+        println!("Every log line throughout the lifetime of the program:");
+        println!("\n{logfile_contents}\n");
+    }
 
-    //state.metrics.num_new_paths.set(num_new_paths);
-
-    Ok(Json(reply))
+    Ok(Json(response))
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -73,7 +136,8 @@ pub struct EnqueuePathsRequest {
 pub struct EnqueuePathsResponse {}
 
 /// Schedule paths in the local Nix store for uploading.
-async fn enqueue_paths(
+#[tracing::instrument(skip_all)]
+async fn post_enqueue_paths(
     Extension(state): Extension<State>,
     Json(req): Json<EnqueuePathsRequest>,
 ) -> Result<Json<EnqueuePathsResponse>> {
@@ -85,6 +149,12 @@ async fn enqueue_paths(
         .map(|path| state.store.follow_store_path(path).map_err(Error::Attic))
         .collect::<Result<Vec<_>>>()?;
 
+    enqueue_paths(&state, store_paths).await?;
+
+    Ok(Json(EnqueuePathsResponse {}))
+}
+
+pub async fn enqueue_paths(state: &State, store_paths: Vec<StorePath>) -> Result<()> {
     if let Some(gha_cache) = &state.gha_cache {
         gha_cache
             .enqueue_paths(state.store.clone(), store_paths.clone())
@@ -95,5 +165,5 @@ async fn enqueue_paths(
         crate::flakehub::enqueue_paths(flakehub_state, store_paths).await?;
     }
 
-    Ok(Json(EnqueuePathsResponse {}))
+    Ok(())
 }

magic-nix-cache/src/binary_cache.rs

@@ -1,14 +1,12 @@
 //! Binary Cache API.
 
-use std::io;
-
 use axum::{
-    extract::{BodyStream, Extension, Path},
+    extract::{Extension, Path},
     response::Redirect,
     routing::{get, put},
     Router,
 };
-use tokio_stream::StreamExt;
+use futures::StreamExt as _;
 use tokio_util::io::StreamReader;
 
 use super::State;
@@ -79,7 +77,7 @@ async fn get_narinfo(
 async fn put_narinfo(
     Extension(state): Extension<State>,
     Path(path): Path<String>,
-    body: BodyStream,
+    body: axum::body::Body,
 ) -> Result<()> {
     let components: Vec<&str> = path.splitn(2, '.').collect();
 
@@ -96,9 +94,13 @@ async fn put_narinfo(
     let store_path_hash = components[0].to_string();
     let key = format!("{}.narinfo", store_path_hash);
     let allocation = gha_cache.api.allocate_file_with_random_suffix(&key).await?;
+
+    let body_stream = body.into_data_stream();
     let stream = StreamReader::new(
-        body.map(|r| r.map_err(|e| io::Error::new(io::ErrorKind::Other, e.to_string()))),
+        body_stream
+            .map(|r| r.map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e.to_string()))),
     );
+
     gha_cache.api.upload_file(allocation, stream).await?;
     state.metrics.narinfos_uploaded.incr();
 
@@ -135,7 +137,7 @@ async fn get_nar(Extension(state): Extension<State>, Path(path): Path<String>) -
 async fn put_nar(
     Extension(state): Extension<State>,
     Path(path): Path<String>,
-    body: BodyStream,
+    body: axum::body::Body,
 ) -> Result<()> {
     let gha_cache = state.gha_cache.as_ref().ok_or(Error::GHADisabled)?;
 
@@ -143,9 +145,13 @@ async fn put_nar(
         .api
         .allocate_file_with_random_suffix(&path)
         .await?;
+
+    let body_stream = body.into_data_stream();
     let stream = StreamReader::new(
-        body.map(|r| r.map_err(|e| io::Error::new(io::ErrorKind::Other, e.to_string()))),
+        body_stream
+            .map(|r| r.map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e.to_string()))),
     );
+
     gha_cache.api.upload_file(allocation, stream).await?;
     state.metrics.nars_uploaded.incr();
 

magic-nix-cache/src/env.rs

@@ -0,0 +1,50 @@
+use std::fmt::{self, Display};
+
+#[derive(Clone, Copy)]
+pub enum Environment {
+    GitHubActions,
+    GitLabCI,
+    Other,
+}
+
+impl Environment {
+    pub fn determine() -> Self {
+        if env_var_is_true("GITHUB_ACTIONS") {
+            return Environment::GitHubActions;
+        }
+
+        if env_var_is_true("GITLAB_CI") {
+            return Environment::GitLabCI;
+        }
+
+        Environment::Other
+    }
+
+    pub fn is_github_actions(&self) -> bool {
+        matches!(self, Self::GitHubActions)
+    }
+
+    pub fn is_gitlab_ci(&self) -> bool {
+        matches!(self, Self::GitLabCI)
+    }
+}
+
+impl Display for Environment {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        use Environment::*;
+
+        write!(
+            f,
+            "{}",
+            match self {
+                GitHubActions => "GitHub Actions",
+                GitLabCI => "GitLab CI",
+                Other => "an unspecified environment",
+            }
+        )
+    }
+}
+
+fn env_var_is_true(e: &str) -> bool {
+    std::env::var(e).is_ok_and(|v| v == "true")
+}

magic-nix-cache/src/error.rs

@@ -19,8 +19,8 @@ pub enum Error {
     #[error("Bad Request")]
     BadRequest,
 
-    #[error("I/O error: {0}")]
-    Io(#[from] std::io::Error),
+    #[error("I/O error: {0}. Context: {1}")]
+    Io(std::io::Error, String),
 
     #[error("GHA cache is disabled")]
     GHADisabled,

magic-nix-cache/src/flakehub.rs

@@ -1,4 +1,7 @@
+use crate::env::Environment;
 use crate::error::{Error, Result};
+use crate::DETERMINATE_NETRC_PATH;
+use anyhow::Context;
 use attic::cache::CacheName;
 use attic::nix_store::{NixStore, StorePath};
 use attic_client::push::{PushSession, PushSessionConfig};
@@ -7,10 +10,12 @@ use attic_client::{
     config::ServerConfig,
     push::{PushConfig, Pusher},
 };
+
 use reqwest::header::HeaderValue;
 use reqwest::Url;
 use serde::Deserialize;
-use std::path::Path;
+use std::os::unix::fs::MetadataExt;
+use std::path::{Path, PathBuf};
 use std::sync::Arc;
 use tokio::fs::File;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
@@ -27,70 +32,59 @@ pub struct State {
 }
 
 pub async fn init_cache(
+    environment: Environment,
     flakehub_api_server: &Url,
-    flakehub_api_server_netrc: &Path,
     flakehub_cache_server: &Url,
-    flakehub_flake_name: Option<String>,
+    flakehub_flake_name: &Option<String>,
     store: Arc<NixStore>,
+    auth_method: &super::FlakeHubAuthSource,
 ) -> Result<State> {
     // Parse netrc to get the credentials for api.flakehub.com.
-    let netrc = {
-        let mut netrc_file = File::open(flakehub_api_server_netrc).await?;
-        let mut netrc_contents = String::new();
-        netrc_file.read_to_string(&mut netrc_contents).await?;
-        netrc_rs::Netrc::parse(netrc_contents, false).map_err(Error::Netrc)?
-    };
+    let netrc_path = auth_method.as_path_buf();
+    let NetrcInfo {
+        netrc,
+        flakehub_cache_server_hostname,
+        flakehub_login,
+        flakehub_password,
+    } = extract_info_from_netrc(&netrc_path, flakehub_api_server, flakehub_cache_server).await?;
 
-    let flakehub_netrc_entry = {
-        netrc
+    if let super::FlakeHubAuthSource::Netrc(netrc_path) = auth_method {
+        // Append an entry for the FlakeHub cache server to netrc.
+        if !netrc
             .machines
             .iter()
-            .find(|machine| {
-                machine.name.as_ref() == flakehub_api_server.host().map(|x| x.to_string()).as_ref()
-            })
-            .ok_or_else(|| Error::MissingCreds(flakehub_api_server.to_string()))?
-            .to_owned()
-    };
+            .any(|machine| machine.name.as_ref() == Some(&flakehub_cache_server_hostname))
+        {
+            let mut netrc_file = tokio::fs::OpenOptions::new()
+                .create(false)
+                .append(true)
+                .open(netrc_path)
+                .await
+                .map_err(|e| {
+                    Error::Internal(format!(
+                        "Failed to open {} for appending: {}",
+                        netrc_path.display(),
+                        e
+                    ))
+                })?;
 
-    let flakehub_cache_server_hostname = flakehub_cache_server
-        .host()
-        .ok_or_else(|| Error::BadUrl(flakehub_cache_server.to_owned()))?
-        .to_string();
-
-    let flakehub_login = flakehub_netrc_entry.login.as_ref().ok_or_else(|| {
-        Error::Config(format!(
-            "netrc file does not contain a login for '{}'",
-            flakehub_api_server
-        ))
-    })?;
-
-    let flakehub_password = flakehub_netrc_entry.password.ok_or_else(|| {
-        Error::Config(format!(
-            "netrc file does not contain a password for '{}'",
-            flakehub_api_server
-        ))
-    })?;
-
-    // Append an entry for the FlakeHub cache server to netrc.
-    if !netrc
-        .machines
-        .iter()
-        .any(|machine| machine.name.as_ref() == Some(&flakehub_cache_server_hostname))
-    {
-        let mut netrc_file = tokio::fs::OpenOptions::new()
-            .create(false)
-            .append(true)
-            .open(flakehub_api_server_netrc)
-            .await?;
-        netrc_file
-            .write_all(
-                format!(
-                    "\nmachine {} login {} password {}\n\n",
-                    flakehub_cache_server_hostname, flakehub_login, flakehub_password,
+            netrc_file
+                .write_all(
+                    format!(
+                        "\nmachine {} login {} password {}\n\n",
+                        flakehub_cache_server_hostname, flakehub_login, flakehub_password,
+                    )
+                    .as_bytes(),
                 )
-                .as_bytes(),
-            )
-            .await?;
+                .await
+                .map_err(|e| {
+                    Error::Internal(format!(
+                        "Failed to write credentials to {}: {}",
+                        netrc_path.display(),
+                        e
+                    ))
+                })?;
+        }
     }
 
     let server_config = ServerConfig {
@@ -102,22 +96,43 @@ pub async fn init_cache(
     let api_inner = ApiClient::from_server_config(server_config)?;
     let api = Arc::new(RwLock::new(api_inner));
 
-    // NOTE(cole-h): This is a workaround -- at the time of writing, GitHub Actions JWTs are only
-    // valid for 5 minutes after being issued. FlakeHub uses these JWTs for authentication, which
-    // means that after those 5 minutes have passed and the token is expired, FlakeHub (and by
-    // extension FlakeHub Cache) will no longer allow requests using this token. However, GitHub
-    // gives us a way to repeatedly request new tokens, so we utilize that and refresh the token
-    // every 2 minutes (less than half of the lifetime of the token).
-    let netrc_path_clone = flakehub_api_server_netrc.to_path_buf();
-    let initial_github_jwt_clone = flakehub_password.clone();
-    let flakehub_cache_server_clone = flakehub_cache_server.to_string();
-    let api_clone = api.clone();
-    tokio::task::spawn(refresh_github_actions_jwt_worker(
-        netrc_path_clone,
-        initial_github_jwt_clone,
-        flakehub_cache_server_clone,
-        api_clone,
-    ));
+    // Periodically refresh JWT in GitHub Actions environment
+    if environment.is_github_actions() {
+        match auth_method {
+            super::FlakeHubAuthSource::Netrc(path) => {
+                let netrc_path_clone = path.to_path_buf();
+                let initial_github_jwt_clone = flakehub_password.clone();
+                let flakehub_cache_server_clone = flakehub_cache_server.to_string();
+                let api_clone = api.clone();
+
+                tokio::task::spawn(refresh_github_actions_jwt_worker(
+                    netrc_path_clone,
+                    initial_github_jwt_clone,
+                    flakehub_cache_server_clone,
+                    api_clone,
+                ));
+            }
+            crate::FlakeHubAuthSource::DeterminateNixd => {
+                let api_clone = api.clone();
+                let netrc_file = PathBuf::from(DETERMINATE_NETRC_PATH);
+                let flakehub_api_server_clone = flakehub_api_server.clone();
+                let flakehub_cache_server_clone = flakehub_cache_server.clone();
+
+                let initial_meta = tokio::fs::metadata(&netrc_file).await.map_err(|e| {
+                    Error::Io(e, format!("getting metadata of {}", netrc_file.display()))
+                })?;
+                let initial_inode = initial_meta.ino();
+
+                tokio::task::spawn(refresh_determinate_token_worker(
+                    netrc_file,
+                    initial_inode,
+                    flakehub_api_server_clone,
+                    flakehub_cache_server_clone,
+                    api_clone,
+                ));
+            }
+        }
+    }
 
     // Get the cache UUID for this project.
     let cache_name = {
@@ -195,6 +210,72 @@ pub async fn init_cache(
     Ok(state)
 }
 
+#[derive(Debug)]
+struct NetrcInfo {
+    netrc: netrc_rs::Netrc,
+    flakehub_cache_server_hostname: String,
+    flakehub_login: String,
+    flakehub_password: String,
+}
+
+#[tracing::instrument]
+async fn extract_info_from_netrc(
+    netrc_path: &Path,
+    flakehub_api_server: &Url,
+    flakehub_cache_server: &Url,
+) -> Result<NetrcInfo> {
+    let netrc = {
+        let mut netrc_file = File::open(netrc_path).await.map_err(|e| {
+            Error::Internal(format!("Failed to open {}: {}", netrc_path.display(), e))
+        })?;
+        let mut netrc_contents = String::new();
+        netrc_file
+            .read_to_string(&mut netrc_contents)
+            .await
+            .map_err(|e| {
+                Error::Internal(format!(
+                    "Failed to read {} contents: {}",
+                    netrc_path.display(),
+                    e
+                ))
+            })?;
+        netrc_rs::Netrc::parse(netrc_contents, false).map_err(Error::Netrc)?
+    };
+
+    let flakehub_netrc_entry = netrc
+        .machines
+        .iter()
+        .find(|machine| {
+            machine.name.as_ref() == flakehub_api_server.host().map(|x| x.to_string()).as_ref()
+        })
+        .ok_or_else(|| Error::MissingCreds(flakehub_api_server.to_string()))?
+        .to_owned();
+
+    let flakehub_cache_server_hostname = flakehub_cache_server
+        .host()
+        .ok_or_else(|| Error::BadUrl(flakehub_cache_server.to_owned()))?
+        .to_string();
+    let flakehub_login = flakehub_netrc_entry.login.ok_or_else(|| {
+        Error::Config(format!(
+            "netrc file does not contain a login for '{}'",
+            flakehub_api_server
+        ))
+    })?;
+    let flakehub_password = flakehub_netrc_entry.password.ok_or_else(|| {
+        Error::Config(format!(
+            "netrc file does not contain a password for '{}'",
+            flakehub_api_server
+        ))
+    })?;
+
+    Ok(NetrcInfo {
+        netrc,
+        flakehub_cache_server_hostname,
+        flakehub_login,
+        flakehub_password,
+    })
+}
+
 pub async fn enqueue_paths(state: &State, store_paths: Vec<StorePath>) -> Result<()> {
     state.push_session.queue_many(store_paths)?;
 
@@ -203,17 +284,29 @@ pub async fn enqueue_paths(state: &State, store_paths: Vec<StorePath>) -> Result
 
 /// Refresh the GitHub Actions JWT every 2 minutes (slightly less than half of the default validity
 /// period) to ensure pushing / pulling doesn't stop working.
+#[tracing::instrument(skip_all)]
 async fn refresh_github_actions_jwt_worker(
     netrc_path: std::path::PathBuf,
     mut github_jwt: String,
     flakehub_cache_server_clone: String,
     api: Arc<RwLock<ApiClient>>,
 ) -> Result<()> {
+    // NOTE(cole-h): This is a workaround -- at the time of writing, GitHub Actions JWTs are only
+    // valid for 5 minutes after being issued. FlakeHub uses these JWTs for authentication, which
+    // means that after those 5 minutes have passed and the token is expired, FlakeHub (and by
+    // extension FlakeHub Cache) will no longer allow requests using this token. However, GitHub
+    // gives us a way to repeatedly request new tokens, so we utilize that and refresh the token
+    // every 2 minutes (less than half of the lifetime of the token).
+
     // TODO(cole-h): this should probably be half of the token's lifetime ((exp - iat) / 2), but
     // getting this is nontrivial so I'm not going to do it until GitHub changes the lifetime and
     // breaks this.
     let next_refresh = std::time::Duration::from_secs(2 * 60);
 
+    // NOTE(cole-h): we sleep until the next refresh at first because we already got a token from
+    // GitHub recently, don't need to try again until we actually might need to get a new one.
+    tokio::time::sleep(next_refresh).await;
+
     // NOTE(cole-h): https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers#requesting-the-jwt-using-environment-variables
     let mut headers = reqwest::header::HeaderMap::new();
     headers.insert(
@@ -264,6 +357,7 @@ async fn refresh_github_actions_jwt_worker(
     }
 }
 
+#[tracing::instrument(skip_all)]
 async fn rewrite_github_actions_token(
     client: &reqwest::Client,
     netrc_path: &Path,
@@ -281,29 +375,118 @@ async fn rewrite_github_actions_token(
         ))
     })?;
 
+    let token_request_url = format!("{runtime_url}&audience=api.flakehub.com");
+    let token_response = client
+        .request(reqwest::Method::GET, &token_request_url)
+        .bearer_auth(runtime_token)
+        .send()
+        .await
+        .with_context(|| format!("sending request to {token_request_url}"))?;
+
+    if let Err(e) = token_response.error_for_status_ref() {
+        tracing::error!(?e, "Got error response when requesting token");
+        return Err(e)?;
+    }
+
     #[derive(serde::Deserialize)]
     struct TokenResponse {
         value: String,
     }
 
-    let res: TokenResponse = client
-        .request(
-            reqwest::Method::GET,
-            format!("{runtime_url}&audience=api.flakehub.com"),
-        )
-        .bearer_auth(runtime_token)
-        .send()
-        .await?
+    let token_response: TokenResponse = token_response
         .json()
-        .await?;
+        .await
+        .with_context(|| "converting response into json")?;
 
-    let new_github_jwt_string = res.value;
-
-    let netrc_contents = tokio::fs::read_to_string(netrc_path).await?;
+    let new_github_jwt_string = token_response.value;
+    let netrc_contents = tokio::fs::read_to_string(netrc_path)
+        .await
+        .with_context(|| format!("failed to read {netrc_path:?} to string"))?;
     let new_netrc_contents = netrc_contents.replace(old_github_jwt, &new_github_jwt_string);
-    let netrc_path_new = tempfile::NamedTempFile::new()?;
-    tokio::fs::write(&netrc_path_new, new_netrc_contents).await?;
-    tokio::fs::rename(&netrc_path_new, netrc_path).await?;
+
+    // NOTE(cole-h): create the temporary file right next to the real one so we don't run into
+    // cross-device linking issues when renaming
+    let netrc_path_tmp = netrc_path.with_extension("tmp");
+    tokio::fs::write(&netrc_path_tmp, new_netrc_contents)
+        .await
+        .with_context(|| format!("writing new JWT to {netrc_path_tmp:?}"))?;
+    tokio::fs::rename(&netrc_path_tmp, &netrc_path)
+        .await
+        .with_context(|| format!("renaming {netrc_path_tmp:?} to {netrc_path:?}"))?;
 
     Ok(new_github_jwt_string)
 }
+
+#[tracing::instrument(skip_all)]
+async fn refresh_determinate_token_worker(
+    netrc_file: PathBuf,
+    mut inode: u64,
+    flakehub_api_server: Url,
+    flakehub_cache_server: Url,
+    api_clone: Arc<RwLock<ApiClient>>,
+) {
+    // NOTE(cole-h): This is a workaround -- at the time of writing, determinate-nixd handles the
+    // GitHub Actions JWT refreshing for us, which means we don't know when this will happen. At the
+    // moment, it does it roughly every 2 minutes (less than half of the total lifetime of the
+    // issued token).
+
+    loop {
+        tokio::time::sleep(std::time::Duration::from_secs(3)).await;
+
+        let meta = tokio::fs::metadata(&netrc_file)
+            .await
+            .map_err(|e| Error::Io(e, format!("getting metadata of {}", netrc_file.display())));
+
+        let Ok(meta) = meta else {
+            tracing::error!(e = ?meta);
+            continue;
+        };
+
+        let current_inode = meta.ino();
+
+        if current_inode == inode {
+            tracing::debug!("current inode is the same, file didn't change");
+            continue;
+        }
+
+        tracing::debug!("current inode is different, file changed");
+        inode = current_inode;
+
+        let flakehub_password = match extract_info_from_netrc(
+            &netrc_file,
+            &flakehub_api_server,
+            &flakehub_cache_server,
+        )
+        .await
+        {
+            Ok(NetrcInfo {
+                flakehub_password, ..
+            }) => flakehub_password,
+            Err(e) => {
+                tracing::error!(?e, "Failed to extract auth info from netrc");
+                continue;
+            }
+        };
+
+        let server_config = ServerConfig {
+            endpoint: flakehub_cache_server.to_string(),
+            token: Some(attic_client::config::ServerTokenConfig::Raw {
+                token: flakehub_password,
+            }),
+        };
+
+        let new_api = ApiClient::from_server_config(server_config.clone());
+
+        let Ok(new_api) = new_api else {
+            tracing::error!(e = ?new_api, "Failed to construct new ApiClient");
+            continue;
+        };
+
+        {
+            let mut api_client = api_clone.write().await;
+            *api_client = new_api;
+        }
+
+        tracing::debug!("Stored new token in API client, sleeping for 30s");
+    }
+}

magic-nix-cache/src/gha.rs

@@ -37,7 +37,15 @@ impl GhaCache {
         metrics: Arc<telemetry::TelemetryReport>,
         narinfo_negative_cache: Arc<RwLock<HashSet<String>>>,
     ) -> Result<GhaCache> {
-        let mut api = Api::new(credentials)?;
+        let cb_metrics = metrics.clone();
+        let mut api = Api::new(
+            credentials,
+            Arc::new(Box::new(move || {
+                cb_metrics
+                    .tripped_429
+                    .store(true, std::sync::atomic::Ordering::Relaxed);
+            })),
+        )?;
 
         if let Some(cache_version) = &cache_version {
             api.mutate_version(cache_version.as_bytes());
@@ -72,7 +80,9 @@ impl GhaCache {
             self.channel_tx
                 .send(Request::Shutdown)
                 .expect("Cannot send shutdown message");
-            worker_result.await.unwrap()
+            worker_result
+                .await
+                .expect("failed to read result from gha worker")
         } else {
             Ok(())
         }
@@ -119,6 +129,11 @@ async fn worker(
                 break;
             }
             Request::Upload(path) => {
+                if api.circuit_breaker_tripped() {
+                    tracing::trace!("GitHub Actions gave us a 429, so we're done.",);
+                    continue;
+                }
+
                 if !done.insert(path.clone()) {
                     continue;
                 }
@@ -184,12 +199,13 @@ async fn upload_path(
 
     let narinfo = path_info_to_nar_info(store.clone(), &path_info, format!("nar/{}", nar_path))
         .to_string()
-        .unwrap();
+        .expect("failed to convert path into to nar info");
 
     tracing::debug!("Uploading '{}'", narinfo_path);
 
     api.upload_file(narinfo_allocation, narinfo.as_bytes())
         .await?;
+
     metrics.narinfos_uploaded.incr();
 
     narinfo_negative_cache
@@ -218,7 +234,17 @@ fn path_info_to_nar_info(store: Arc<NixStore>, path_info: &ValidPathInfo, url: S
         references: path_info
             .references
             .iter()
-            .map(|r| r.file_name().unwrap().to_str().unwrap().to_owned())
+            .map(|r| {
+                r.file_name()
+                    .and_then(|n| n.to_str())
+                    .unwrap_or_else(|| {
+                        panic!(
+                            "failed to convert nar_info reference to string: {}",
+                            r.display()
+                        )
+                    })
+                    .to_owned()
+            })
             .collect(),
         system: None,
         deriver: None,

magic-nix-cache/src/main.rs

@@ -14,16 +14,18 @@
 
 mod api;
 mod binary_cache;
+mod env;
 mod error;
 mod flakehub;
 mod gha;
+mod pbh;
 mod telemetry;
+mod util;
 
 use std::collections::HashSet;
-use std::fs::{self, create_dir_all, OpenOptions};
+use std::fs::create_dir_all;
 use std::io::Write;
 use std::net::SocketAddr;
-use std::os::unix::fs::PermissionsExt;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
@@ -31,25 +33,33 @@ use ::attic::nix_store::NixStore;
 use anyhow::{anyhow, Context, Result};
 use axum::{extract::Extension, routing::get, Router};
 use clap::Parser;
-use tempfile::NamedTempFile;
-use tokio::process::Command;
+use serde::{Deserialize, Serialize};
+use tokio::fs::File;
+use tokio::io::AsyncWriteExt;
 use tokio::sync::{oneshot, Mutex, RwLock};
 use tracing_subscriber::filter::EnvFilter;
+use tracing_subscriber::layer::SubscriberExt;
+use tracing_subscriber::util::SubscriberInitExt;
 
 use gha_cache::Credentials;
 
+const DETERMINATE_STATE_DIR: &str = "/nix/var/determinate";
+const DETERMINATE_NIXD_SOCKET_NAME: &str = "determinate-nixd.socket";
+const DETERMINATE_NETRC_PATH: &str = "/nix/var/determinate/netrc";
+
+// TODO(colemickens): refactor, move with other UDS stuff (or all PBH stuff) to new file
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(tag = "c", rename_all = "kebab-case")]
+pub struct BuiltPathResponseEventV1 {
+    pub drv: PathBuf,
+    pub outputs: Vec<PathBuf>,
+}
+
 type State = Arc<StateInner>;
 
 /// GitHub Actions-powered Nix binary cache
 #[derive(Parser, Debug)]
 struct Args {
-    /// JSON file containing credentials.
-    ///
-    /// If this is not specified, credentials will be loaded
-    /// from the environment.
-    #[arg(short = 'c', long)]
-    credentials_file: Option<PathBuf>,
-
     /// Address to listen on.
     ///
     /// FIXME: IPv6
@@ -81,35 +91,111 @@ struct Args {
     diagnostic_endpoint: String,
 
     /// The FlakeHub API server.
-    #[arg(long)]
-    flakehub_api_server: Option<reqwest::Url>,
+    #[arg(long, default_value = "https://api.flakehub.com")]
+    flakehub_api_server: reqwest::Url,
 
     /// The path of the `netrc` file that contains the FlakeHub JWT token.
     #[arg(long)]
     flakehub_api_server_netrc: Option<PathBuf>,
 
     /// The FlakeHub binary cache server.
-    #[arg(long)]
-    flakehub_cache_server: Option<reqwest::Url>,
+    #[arg(long, default_value = "https://cache.flakehub.com")]
+    flakehub_cache_server: reqwest::Url,
 
     #[arg(long)]
     flakehub_flake_name: Option<String>,
 
     /// The location of `nix.conf`.
-    #[arg(long)]
+    #[arg(long, default_value_os_t = default_nix_conf())]
     nix_conf: PathBuf,
 
     /// Whether to use the GHA cache.
     #[arg(long)]
-    use_gha_cache: bool,
+    use_gha_cache: Option<Option<CacheTrinary>>,
 
     /// Whether to use the FlakeHub binary cache.
     #[arg(long)]
-    use_flakehub: bool,
+    use_flakehub: Option<Option<CacheTrinary>>,
 
     /// URL to which to post startup notification.
     #[arg(long)]
     startup_notification_url: Option<reqwest::Url>,
+
+    /// File to write to when indicating startup.
+    #[arg(long)]
+    startup_notification_file: Option<PathBuf>,
+
+    /// Whether or not to diff the store before and after Magic Nix Cache runs
+    #[arg(long, default_value_t = false)]
+    diff_store: bool,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, clap::ValueEnum)]
+pub enum CacheTrinary {
+    NoPreference,
+    Enabled,
+    Disabled,
+}
+
+impl From<Option<Option<CacheTrinary>>> for CacheTrinary {
+    fn from(b: Option<Option<CacheTrinary>>) -> Self {
+        match b {
+            None => CacheTrinary::NoPreference,
+            Some(None) => CacheTrinary::Enabled,
+            Some(Some(v)) => v,
+        }
+    }
+}
+
+#[derive(PartialEq, Clone, Copy)]
+pub enum Dnixd {
+    Available,
+    Missing,
+}
+
+impl From<bool> for Dnixd {
+    fn from(b: bool) -> Self {
+        if b {
+            Dnixd::Available
+        } else {
+            Dnixd::Missing
+        }
+    }
+}
+
+impl Args {
+    fn validate(&self, environment: env::Environment) -> Result<(), error::Error> {
+        if environment.is_gitlab_ci() && self.github_cache_preference() == CacheTrinary::Enabled {
+            return Err(error::Error::Config(String::from(
+                "the --use-gha-cache flag should not be applied in GitLab CI",
+            )));
+        }
+
+        if environment.is_gitlab_ci() && self.flakehub_preference() != CacheTrinary::Enabled {
+            return Err(error::Error::Config(String::from(
+                "you must set --use-flakehub in GitLab CI",
+            )));
+        }
+
+        Ok(())
+    }
+
+    fn github_cache_preference(&self) -> CacheTrinary {
+        self.use_gha_cache.into()
+    }
+
+    fn flakehub_preference(&self) -> CacheTrinary {
+        self.use_flakehub.into()
+    }
+}
+
+fn default_nix_conf() -> PathBuf {
+    xdg::BaseDirectories::new()
+        .with_context(|| "identifying XDG base directories")
+        .expect(
+            "Could not identify your home directory. Try setting the HOME environment variable.",
+        )
+        .get_config_file("nix/nix.conf")
 }
 
 /// The global server state.
@@ -134,66 +220,154 @@ struct StateInner {
 
     /// FlakeHub cache state.
     flakehub_state: RwLock<Option<flakehub::State>>,
+
+    /// Where all of tracing will log to when GitHub Actions is run in debug mode
+    logfile: Option<PathBuf>,
+
+    /// The paths in the Nix store when Magic Nix Cache started, if store diffing is enabled.
+    original_paths: Option<Mutex<HashSet<PathBuf>>>,
+}
+
+#[derive(Debug, Clone)]
+pub(crate) enum FlakeHubAuthSource {
+    DeterminateNixd,
+    Netrc(PathBuf),
+}
+
+impl FlakeHubAuthSource {
+    pub(crate) fn as_path_buf(&self) -> PathBuf {
+        match &self {
+            Self::Netrc(path) => path.clone(),
+            Self::DeterminateNixd => {
+                let mut path = PathBuf::from(DETERMINATE_STATE_DIR);
+                path.push("netrc");
+
+                path
+            }
+        }
+    }
 }
 
 async fn main_cli() -> Result<()> {
-    init_logging();
+    let guard = init_logging()?;
+    let _tracing_guard = guard.appender_guard;
 
     let args = Args::parse();
+    let environment = env::Environment::determine();
+    tracing::debug!("Running in {}", environment.to_string());
+    args.validate(environment)?;
 
     let metrics = Arc::new(telemetry::TelemetryReport::new());
 
-    if let Some(parent) = Path::new(&args.nix_conf).parent() {
+    let dnixd_uds_socket_dir: &Path = Path::new(&DETERMINATE_STATE_DIR);
+    let dnixd_uds_socket_path = dnixd_uds_socket_dir.join(DETERMINATE_NIXD_SOCKET_NAME);
+    let dnixd_available: Dnixd = dnixd_uds_socket_path.exists().into();
+
+    let nix_conf_path: PathBuf = args.nix_conf.clone();
+
+    // NOTE: we expect this to point to a user nix.conf
+    // we always open/append to it to be able to append the extra-substituter for github-actions cache
+    // but we don't write to it for initializing flakehub_cache unless dnixd is unavailable
+    if let Some(parent) = Path::new(&nix_conf_path).parent() {
         create_dir_all(parent).with_context(|| "Creating parent directories of nix.conf")?;
     }
-
-    let mut nix_conf = OpenOptions::new()
+    let mut nix_conf = std::fs::OpenOptions::new()
         .create(true)
         .append(true)
-        .open(args.nix_conf)
+        .open(&nix_conf_path)
         .with_context(|| "Creating nix.conf")?;
 
+    // always enable fallback, first
+    nix_conf
+        .write_all(b"fallback = true\n")
+        .with_context(|| "Setting fallback in nix.conf")?;
+
     let store = Arc::new(NixStore::connect()?);
 
     let narinfo_negative_cache = Arc::new(RwLock::new(HashSet::new()));
 
-    let flakehub_state = if args.use_flakehub {
-        let flakehub_cache_server = args
-            .flakehub_cache_server
-            .ok_or_else(|| anyhow!("--flakehub-cache-server is required"))?;
-        let flakehub_api_server_netrc = args
-            .flakehub_api_server_netrc
-            .ok_or_else(|| anyhow!("--flakehub-api-server-netrc is required"))?;
-        let flakehub_flake_name = args.flakehub_flake_name;
+    let flakehub_auth_method: Option<FlakeHubAuthSource> = match (
+        args.flakehub_preference(),
+        &args.flakehub_api_server_netrc,
+        dnixd_available,
+    ) {
+        // User has explicitly pyassed --use-flakehub=disabled, so just straight up don't
+        (CacheTrinary::Disabled, _, _) => {
+            tracing::info!("Disabling FlakeHub cache.");
+            None
+        }
+
+        // User has no preference, did not pass a netrc, and determinate-nixd is not available
+        (CacheTrinary::NoPreference, None, Dnixd::Missing) => None,
+
+        // Use it when determinate-nixd is available, and let the user know what's going on
+        (pref, user_netrc_path, Dnixd::Available) => {
+            if pref == CacheTrinary::NoPreference {
+                tracing::info!("Enabling FlakeHub cache because determinate-nixd is available.");
+            }
+
+            if user_netrc_path.is_some() {
+                tracing::info!("Ignoring the user-specified --flakehub-api-server-netrc, in favor of the determinate-nixd netrc");
+            }
+
+            Some(FlakeHubAuthSource::DeterminateNixd)
+        }
+
+        // When determinate-nixd is not available, but the user specified a netrc
+        (_, Some(path), Dnixd::Missing) => {
+            if path.exists() {
+                Some(FlakeHubAuthSource::Netrc(path.to_owned()))
+            } else {
+                tracing::debug!(path = %path.display(), "User-provided netrc does not exist");
+                None
+            }
+        }
+
+        // User explicitly turned on flakehub cache, but we have no netrc and determinate-nixd is not present
+        (CacheTrinary::Enabled, None, Dnixd::Missing) => {
+            return Err(anyhow!(
+                "--flakehub-api-server-netrc is required when determinate-nixd is unavailable"
+            ));
+        }
+    };
+
+    let flakehub_state = if let Some(auth_method) = flakehub_auth_method {
+        let flakehub_cache_server = &args.flakehub_cache_server;
+
+        let flakehub_api_server = &args.flakehub_api_server;
+
+        let flakehub_flake_name = &args.flakehub_flake_name;
 
         match flakehub::init_cache(
-            &args
-                .flakehub_api_server
-                .ok_or_else(|| anyhow!("--flakehub-api-server is required"))?,
-            &flakehub_api_server_netrc,
-            &flakehub_cache_server,
+            environment,
+            flakehub_api_server,
+            flakehub_cache_server,
             flakehub_flake_name,
             store.clone(),
+            &auth_method,
         )
         .await
         {
             Ok(state) => {
-                nix_conf
-                    .write_all(
-                        format!(
-                            "extra-substituters = {}?trusted=1\nnetrc-file = {}\n",
-                            &flakehub_cache_server,
-                            flakehub_api_server_netrc.display()
+                if let FlakeHubAuthSource::Netrc(ref path) = auth_method {
+                    nix_conf
+                        .write_all(
+                            format!(
+                                "extra-substituters = {}?trusted=1\nnetrc-file = {}\n",
+                                &flakehub_cache_server,
+                                path.display()
+                            )
+                            .as_bytes(),
                         )
-                        .as_bytes(),
-                    )
-                    .with_context(|| "Writing to nix.conf")?;
+                        .with_context(|| "Writing to nix.conf")?;
+                }
 
                 tracing::info!("FlakeHub cache is enabled.");
                 Some(state)
             }
             Err(err) => {
-                tracing::debug!("FlakeHub cache initialization failed: {}", err);
+                tracing::error!("FlakeHub cache initialization failed: {}. Unable to authenticate to FlakeHub. Individuals must register at FlakeHub.com; Organizations must create an organization at FlakeHub.com.", err);
+                println!("::error title={{FlakeHub: Unauthenticated}}::{{Unable to authenticate to FlakeHub. Individuals must register at FlakeHub.com; Organizations must create an organization at FlakeHub.com.}}");
                 None
             }
         }
@@ -202,27 +376,14 @@ async fn main_cli() -> Result<()> {
         None
     };
 
-    let gha_cache = if args.use_gha_cache {
-        let credentials = if let Some(credentials_file) = &args.credentials_file {
-            tracing::info!("Loading credentials from {:?}", credentials_file);
-            let bytes = fs::read(credentials_file).with_context(|| {
-                format!(
-                    "Failed to read credentials file '{}'",
-                    credentials_file.display()
-                )
-            })?;
+    let gha_cache = if (args.github_cache_preference() == CacheTrinary::Enabled)
+        || (args.github_cache_preference() == CacheTrinary::NoPreference
+            && flakehub_state.is_none())
+    {
+        tracing::info!("Loading credentials from environment");
 
-            serde_json::from_slice(&bytes).with_context(|| {
-                format!(
-                    "Failed to deserialize credentials file '{}'",
-                    credentials_file.display()
-                )
-            })?
-        } else {
-            tracing::info!("Loading credentials from environment");
-            Credentials::load_from_env()
-                .with_context(|| "Failed to load credentials from environment (see README.md)")?
-        };
+        let credentials = Credentials::load_from_env()
+            .with_context(|| "Failed to load credentials from environment (see README.md)")?;
 
         let gha_cache = gha::GhaCache::new(
             credentials,
@@ -240,70 +401,13 @@ async fn main_cli() -> Result<()> {
         tracing::info!("Native GitHub Action cache is enabled.");
         Some(gha_cache)
     } else {
-        tracing::info!("Native GitHub Action cache is disabled.");
+        if environment.is_github_actions() {
+            tracing::info!("Native GitHub Action cache is disabled.");
+        }
+
         None
     };
 
-    /* Write the post-build hook script. Note that the shell script
-     * ignores errors, to avoid the Nix build from failing. */
-    let post_build_hook_script = {
-        let mut file = NamedTempFile::with_prefix("magic-nix-cache-build-hook-")
-            .with_context(|| "Creating a temporary file for the post-build hook")?;
-        file.write_all(
-            format!(
-                // NOTE(cole-h): We want to exit 0 even if the hook failed, otherwise it'll fail the
-                // build itself
-                "#! /bin/sh\nRUST_LOG=trace RUST_BACKTRACE=full {} --server {} || :\n",
-                std::env::current_exe()
-                    .with_context(|| "Getting the path of magic-nix-cache")?
-                    .display(),
-                args.listen
-            )
-            .as_bytes(),
-        )
-        .with_context(|| "Writing the post-build hook")?;
-        let path = file
-            .keep()
-            .with_context(|| "Keeping the post-build hook")?
-            .1;
-
-        fs::set_permissions(&path, fs::Permissions::from_mode(0o755))
-            .with_context(|| "Setting permissions on the post-build hook")?;
-
-        /* Copy the script to the Nix store so we know for sure that
-         * it's accessible to the Nix daemon, which might have a
-         * different /tmp from us. */
-        let res = Command::new("nix")
-            .args([
-                "--extra-experimental-features",
-                "nix-command",
-                "store",
-                "add-path",
-                &path.display().to_string(),
-            ])
-            .output()
-            .await?;
-        if res.status.success() {
-            tokio::fs::remove_file(path).await?;
-            PathBuf::from(String::from_utf8_lossy(&res.stdout).trim())
-        } else {
-            path
-        }
-    };
-
-    /* Update nix.conf. */
-    nix_conf
-        .write_all(
-            format!(
-                "fallback = true\npost-build-hook = {}\n",
-                post_build_hook_script.display()
-            )
-            .as_bytes(),
-        )
-        .with_context(|| "Writing to nix.conf")?;
-
-    drop(nix_conf);
-
     let diagnostic_endpoint = match args.diagnostic_endpoint.as_str() {
         "" => {
             tracing::info!("Diagnostics disabled.");
@@ -314,6 +418,7 @@ async fn main_cli() -> Result<()> {
 
     let (shutdown_sender, shutdown_receiver) = oneshot::channel();
 
+    let original_paths = args.diff_store.then_some(Mutex::new(HashSet::new()));
     let state = Arc::new(StateInner {
         gha_cache,
         upstream: args.upstream.clone(),
@@ -322,8 +427,20 @@ async fn main_cli() -> Result<()> {
         metrics,
         store,
         flakehub_state: RwLock::new(flakehub_state),
+        logfile: guard.logfile,
+        original_paths,
     });
 
+    if dnixd_available == Dnixd::Available {
+        tracing::info!("Subscribing to Determinate Nixd build events.");
+        crate::pbh::subscribe_uds_post_build_hook(dnixd_uds_socket_path, state.clone()).await?;
+    } else {
+        tracing::info!("Patching nix.conf to use a post-build-hook.");
+        crate::pbh::setup_legacy_post_build_hook(&args.listen, &mut nix_conf).await?;
+    }
+
+    drop(nix_conf);
+
     let app = Router::new()
         .route("/", get(root))
         .merge(api::get_router())
@@ -338,7 +455,10 @@ async fn main_cli() -> Result<()> {
 
     tracing::info!("Listening on {}", args.listen);
 
+    // Notify of startup via HTTP
     if let Some(startup_notification_url) = args.startup_notification_url {
+        tracing::debug!("Startup notification via HTTP POST to {startup_notification_url}");
+
         let response = reqwest::Client::new()
             .post(startup_notification_url)
             .header(reqwest::header::CONTENT_TYPE, "application/json")
@@ -364,14 +484,52 @@ async fn main_cli() -> Result<()> {
         }
     }
 
-    let ret = axum::Server::bind(&args.listen)
-        .serve(app.into_make_service())
+    // Notify of startup by writing "1" to the specified file
+    if let Some(startup_notification_file_path) = args.startup_notification_file {
+        let file_contents: &[u8] = b"1";
+
+        tracing::debug!("Startup notification via file at {startup_notification_file_path:?}");
+
+        if let Some(parent_dir) = startup_notification_file_path.parent() {
+            tokio::fs::create_dir_all(parent_dir)
+                .await
+                .with_context(|| {
+                    format!(
+                        "failed to create parent directory for startup notification file path: {}",
+                        startup_notification_file_path.display()
+                    )
+                })?;
+        }
+        let mut notification_file = File::create(&startup_notification_file_path)
+            .await
+            .with_context(|| {
+                format!(
+                    "failed to create startup notification file to path: {}",
+                    startup_notification_file_path.display()
+                )
+            })?;
+        notification_file
+            .write_all(file_contents)
+            .await
+            .with_context(|| {
+                format!(
+                    "failed to write startup notification file to path: {}",
+                    startup_notification_file_path.display()
+                )
+            })?;
+
+        tracing::debug!("Created startup notification file at {startup_notification_file_path:?}");
+    }
+
+    let listener = tokio::net::TcpListener::bind(&args.listen).await?;
+    let ret = axum::serve(listener, app.into_make_service())
         .with_graceful_shutdown(async move {
             shutdown_receiver.await.ok();
             tracing::info!("Shutting down");
         })
         .await;
 
+    // Notify diagnostics endpoint
     if let Some(diagnostic_endpoint) = diagnostic_endpoint {
         state.metrics.send(diagnostic_endpoint).await;
     }
@@ -381,85 +539,90 @@ async fn main_cli() -> Result<()> {
     Ok(())
 }
 
-async fn post_build_hook(out_paths: &str) -> Result<()> {
-    #[derive(Parser, Debug)]
-    struct Args {
-        /// `magic-nix-cache` daemon to connect to.
-        #[arg(short = 'l', long, default_value = "127.0.0.1:3000")]
-        server: SocketAddr,
-    }
-
-    let args = Args::parse();
-
-    let store_paths: Vec<_> = out_paths
-        .split_whitespace()
-        .map(|s| s.trim().to_owned())
-        .collect();
-
-    let request = api::EnqueuePathsRequest { store_paths };
-
-    let response = reqwest::Client::new()
-        .post(format!("http://{}/api/enqueue-paths", &args.server))
-        .header(reqwest::header::CONTENT_TYPE, "application/json")
-        .body(
-            serde_json::to_string(&request)
-                .with_context(|| "Decoding the response from the magic-nix-cache server")?,
-        )
-        .send()
-        .await;
-
-    match response {
-        Ok(response) if !response.status().is_success() => Err(anyhow!(
-            "magic-nix-cache server failed to enqueue the push request: {}\n{}",
-            response.status(),
-            response
-                .text()
-                .await
-                .unwrap_or_else(|_| "<no response text>".to_owned()),
-        ))?,
-        Ok(response) => response
-            .json::<api::EnqueuePathsResponse>()
-            .await
-            .with_context(|| "magic-nix-cache-server didn't return a valid response")?,
-        Err(err) => {
-            Err(err).with_context(|| "magic-nix-cache server failed to send the enqueue request")?
-        }
-    };
-
-    Ok(())
-}
-
 #[tokio::main]
 async fn main() -> Result<()> {
     match std::env::var("OUT_PATHS") {
-        Ok(out_paths) => post_build_hook(&out_paths).await,
+        Ok(out_paths) => pbh::handle_legacy_post_build_hook(&out_paths).await,
         Err(_) => main_cli().await,
     }
 }
 
-fn init_logging() {
+pub(crate) fn debug_logfile() -> PathBuf {
+    std::env::temp_dir().join("magic-nix-cache-tracing.log")
+}
+
+pub struct LogGuard {
+    appender_guard: Option<tracing_appender::non_blocking::WorkerGuard>,
+    logfile: Option<PathBuf>,
+}
+
+fn init_logging() -> Result<LogGuard> {
     let filter = EnvFilter::try_from_default_env().unwrap_or_else(|_| {
         #[cfg(debug_assertions)]
         return EnvFilter::new("info")
-            .add_directive("magic_nix_cache=debug".parse().unwrap())
-            .add_directive("gha_cache=debug".parse().unwrap());
+            .add_directive(
+                "magic_nix_cache=debug"
+                    .parse()
+                    .expect("failed to parse magix_nix_cache directive"),
+            )
+            .add_directive(
+                "gha_cache=debug"
+                    .parse()
+                    .expect("failed to parse gha_cahce directive"),
+            );
 
         #[cfg(not(debug_assertions))]
         return EnvFilter::new("info");
     });
 
-    tracing_subscriber::fmt()
+    let stderr_layer = tracing_subscriber::fmt::layer()
         .with_writer(std::io::stderr)
-        .pretty()
-        .with_env_filter(filter)
+        .pretty();
+
+    let (guard, file_layer) = match std::env::var("RUNNER_DEBUG") {
+        Ok(val) if val == "1" => {
+            let logfile = debug_logfile();
+            let file = std::fs::OpenOptions::new()
+                .create(true)
+                .write(true)
+                .truncate(true)
+                .open(&logfile)?;
+            let (nonblocking, guard) = tracing_appender::non_blocking(file);
+            let file_layer = tracing_subscriber::fmt::layer()
+                .with_writer(nonblocking)
+                .pretty();
+
+            (
+                LogGuard {
+                    appender_guard: Some(guard),
+                    logfile: Some(logfile),
+                },
+                Some(file_layer),
+            )
+        }
+        _ => (
+            LogGuard {
+                appender_guard: None,
+                logfile: None,
+            },
+            None,
+        ),
+    };
+
+    tracing_subscriber::registry()
+        .with(filter)
+        .with(stderr_layer)
+        .with(file_layer)
         .init();
+
+    Ok(guard)
 }
 
 #[cfg(debug_assertions)]
-async fn dump_api_stats<B>(
+async fn dump_api_stats(
     Extension(state): Extension<State>,
-    request: axum::http::Request<B>,
-    next: axum::middleware::Next<B>,
+    request: axum::http::Request<axum::body::Body>,
+    next: axum::middleware::Next,
 ) -> axum::response::Response {
     if let Some(gha_cache) = &state.gha_cache {
         gha_cache.api.dump_stats();

magic-nix-cache/src/pbh.rs

@@ -0,0 +1,241 @@
+use std::io::Write as _;
+use std::net::SocketAddr;
+use std::os::unix::fs::PermissionsExt as _;
+use std::path::PathBuf;
+
+use anyhow::anyhow;
+use anyhow::Context as _;
+use anyhow::Result;
+use clap::Parser;
+use futures::StreamExt as _;
+use http_body_util::BodyExt as _;
+use hyper_util::rt::TokioExecutor;
+use hyper_util::rt::TokioIo;
+use tempfile::NamedTempFile;
+use tokio::net::UnixStream;
+use tokio::process::Command;
+
+use crate::BuiltPathResponseEventV1;
+use crate::State;
+
+pub async fn subscribe_uds_post_build_hook(
+    dnixd_uds_socket_path: PathBuf,
+    state: State,
+) -> Result<()> {
+    tokio::spawn(async move {
+        let dnixd_uds_socket_path = &dnixd_uds_socket_path;
+        loop {
+            let Ok(socket_conn) = UnixStream::connect(dnixd_uds_socket_path).await else {
+                tracing::error!("built-paths: failed to connect to determinate-nixd's socket");
+                tokio::time::sleep(std::time::Duration::from_secs(10)).await;
+                continue;
+            };
+            let stream = TokioIo::new(socket_conn);
+            let executor: TokioExecutor = TokioExecutor::new();
+
+            let sender_conn = hyper::client::conn::http2::handshake(executor, stream).await;
+
+            let Ok((mut sender, conn)) = sender_conn else {
+                tracing::error!("built-paths: failed to http2 handshake");
+                continue;
+            };
+
+            // NOTE(colemickens): for now we just drop the joinhandle and let it keep running
+            let _join_handle = tokio::task::spawn(async move {
+                if let Err(err) = conn.await {
+                    tracing::error!("Connection failed: {:?}", err);
+                }
+            });
+
+            let request = http::Request::builder()
+                .method(http::Method::GET)
+                .uri("http://localhost/events")
+                .body(axum::body::Body::empty());
+            let Ok(request) = request else {
+                tracing::error!("built-paths: failed to create request to subscribe");
+                continue;
+            };
+
+            let response = sender.send_request(request).await;
+            let response = match response {
+                Ok(r) => r,
+                Err(e) => {
+                    tracing::error!("buit-paths: failed to send subscription request: {:?}", e);
+                    continue;
+                }
+            };
+            let mut data = response.into_data_stream();
+
+            while let Some(event_str) = data.next().await {
+                let event_str = match event_str {
+                    Ok(event) => event,
+                    Err(e) => {
+                        tracing::error!("built-paths: error while receiving: {}", e);
+                        break;
+                    }
+                };
+
+                let Some(event_str) = event_str.strip_prefix("data: ".as_bytes()) else {
+                    tracing::debug!("built-paths subscription: ignoring non-data frame");
+                    continue;
+                };
+                let Ok(event): core::result::Result<BuiltPathResponseEventV1, _> =
+                    serde_json::from_slice(event_str)
+                else {
+                    tracing::error!(
+                        "failed to decode built-path response as BuiltPathResponseEventV1"
+                    );
+                    continue;
+                };
+
+                let maybe_store_paths = event
+                    .outputs
+                    .iter()
+                    .map(|path| {
+                        state
+                            .store
+                            .follow_store_path(path)
+                            .map_err(|_| anyhow!("failed to collect store paths"))
+                    })
+                    .collect::<Result<Vec<_>>>();
+
+                let Ok(store_paths) = maybe_store_paths else {
+                    tracing::error!(
+                        "built-paths: encountered an error aggregating build store paths"
+                    );
+                    continue;
+                };
+
+                tracing::debug!("about to enqueue paths: {:?}", store_paths);
+                if let Err(e) = crate::api::enqueue_paths(&state, store_paths).await {
+                    tracing::error!(
+                        "built-paths: failed to enqueue paths for drv ({}): {}",
+                        event.drv.display(),
+                        e
+                    );
+                    continue;
+                }
+            }
+        }
+    });
+
+    Ok(())
+}
+
+pub async fn setup_legacy_post_build_hook(
+    listen: &SocketAddr,
+    nix_conf: &mut std::fs::File,
+) -> Result<()> {
+    /* Write the post-build hook script. Note that the shell script
+     * ignores errors, to avoid the Nix build from failing. */
+    let post_build_hook_script = {
+        let mut file = NamedTempFile::with_prefix("magic-nix-cache-build-hook-")
+            .with_context(|| "Creating a temporary file for the post-build hook")?;
+        file.write_all(
+            format!(
+                // NOTE(cole-h): We want to exit 0 even if the hook failed, otherwise it'll fail the
+                // build itself
+                "#! /bin/sh\nRUST_LOG=trace RUST_BACKTRACE=full {} --server {} || :\n",
+                std::env::current_exe()
+                    .with_context(|| "Getting the path of magic-nix-cache")?
+                    .display(),
+                listen
+            )
+            .as_bytes(),
+        )
+        .with_context(|| "Writing the post-build hook")?;
+        let path = file
+            .keep()
+            .with_context(|| "Keeping the post-build hook")?
+            .1;
+
+        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o755))
+            .with_context(|| "Setting permissions on the post-build hook")?;
+
+        /* Copy the script to the Nix store so we know for sure that
+         * it's accessible to the Nix daemon, which might have a
+         * different /tmp from us. */
+        let res = Command::new("nix")
+            .args([
+                "--extra-experimental-features",
+                "nix-command",
+                "store",
+                "add-path",
+                &path.display().to_string(),
+            ])
+            .output()
+            .await
+            .with_context(|| {
+                format!(
+                    "Running nix to add the post-build-hook to the store from {}",
+                    path.display()
+                )
+            })?;
+        if res.status.success() {
+            tokio::fs::remove_file(&path).await.with_context(|| {
+                format!(
+                    "Cleaning up the temporary post-build-hook at {}",
+                    path.display()
+                )
+            })?;
+            PathBuf::from(String::from_utf8_lossy(&res.stdout).trim())
+        } else {
+            path
+        }
+    };
+
+    /* Update nix.conf. */
+    nix_conf
+        .write_all(format!("post-build-hook = {}\n", post_build_hook_script.display()).as_bytes())
+        .with_context(|| "Writing to nix.conf")?;
+
+    Ok(())
+}
+
+pub async fn handle_legacy_post_build_hook(out_paths: &str) -> Result<()> {
+    #[derive(Parser, Debug)]
+    struct Args {
+        /// `magic-nix-cache` daemon to connect to.
+        #[arg(short = 'l', long, default_value = "127.0.0.1:3000")]
+        server: SocketAddr,
+    }
+
+    let args = Args::parse();
+
+    let store_paths: Vec<_> = out_paths
+        .split_whitespace()
+        .map(|s| s.trim().to_owned())
+        .collect();
+
+    let request = crate::api::EnqueuePathsRequest { store_paths };
+
+    let response = reqwest::Client::new()
+        .post(format!("http://{}/api/enqueue-paths", &args.server))
+        .header(reqwest::header::CONTENT_TYPE, "application/json")
+        .body(
+            serde_json::to_string(&request)
+                .with_context(|| "Decoding the response from the magic-nix-cache server")?,
+        )
+        .send()
+        .await;
+
+    match response {
+        Ok(response) if !response.status().is_success() => Err(anyhow!(
+            "magic-nix-cache server failed to enqueue the push request: {}\n{}",
+            response.status(),
+            response
+                .text()
+                .await
+                .unwrap_or_else(|_| "<no response text>".to_owned()),
+        ))?,
+        Ok(response) => response
+            .json::<crate::api::EnqueuePathsResponse>()
+            .await
+            .with_context(|| "magic-nix-cache-server didn't return a valid response")?,
+        Err(err) => {
+            Err(err).with_context(|| "magic-nix-cache server failed to send the enqueue request")?
+        }
+    };
+
+    Ok(())
+}

magic-nix-cache/src/telemetry.rs

@@ -28,6 +28,8 @@ pub struct TelemetryReport {
     pub num_original_paths: Metric,
     pub num_final_paths: Metric,
     pub num_new_paths: Metric,
+
+    pub tripped_429: std::sync::atomic::AtomicBool,
 }
 
 #[derive(Debug, Default, serde::Serialize)]

magic-nix-cache/src/util.rs

@@ -0,0 +1,52 @@
+//! Utilities.
+
+use std::collections::HashSet;
+use std::path::{Path, PathBuf};
+
+use attic::nix_store::NixStore;
+
+use crate::error::Result;
+
+/// Returns the list of store paths that are currently present.
+pub async fn get_store_paths(store: &NixStore) -> Result<HashSet<PathBuf>> {
+    // FIXME: use the Nix API.
+    let store_dir = store.store_dir();
+    let mut listing = tokio::fs::read_dir(store_dir).await.map_err(|e| {
+        crate::error::Error::Io(
+            e,
+            format!("Enumerating store paths in {}", store_dir.display()),
+        )
+    })?;
+    let mut paths = HashSet::new();
+    while let Some(entry) = listing.next_entry().await.map_err(|e| {
+        crate::error::Error::Io(
+            e,
+            format!("Reading existing store paths from {}", store_dir.display()),
+        )
+    })? {
+        let file_name = entry.file_name();
+        let file_name = Path::new(&file_name);
+
+        if let Some(extension) = file_name.extension() {
+            match extension.to_str() {
+                None | Some("drv") | Some("chroot") => {
+                    tracing::debug!(
+                        "skipping file with weird or uninteresting extension {extension:?}"
+                    );
+                    continue;
+                }
+                _ => {}
+            }
+        }
+
+        if let Some(s) = file_name.to_str() {
+            // Special paths (so far only `.links`)
+            if s == ".links" {
+                continue;
+            }
+        }
+
+        paths.insert(store_dir.join(file_name));
+    }
+    Ok(paths)
+}

nix.patch

@@ -1,48 +0,0 @@
-diff --git a/mk/libraries.mk b/mk/libraries.mk
-index 6541775f329..5118b957608 100644
---- a/mk/libraries.mk
-+++ b/mk/libraries.mk
-@@ -130,7 +130,15 @@ define build-library
- 
-     $(1)_LDFLAGS_USE += $$($(1)_PATH) $$($(1)_LDFLAGS)
- 
--    $(1)_INSTALL_PATH := $$(libdir)/$$($(1)_NAME).a
-+    $(1)_INSTALL_PATH := $(DESTDIR)$$($(1)_INSTALL_DIR)/$$($(1)_NAME).a
-+
-+    $$(eval $$(call create-dir, $$($(1)_INSTALL_DIR)))
-+
-+    $$($(1)_INSTALL_PATH): $$($(1)_OBJS) | $(DESTDIR)$$($(1)_INSTALL_DIR)/
-+	+$$(trace-ld) $(LD) -Ur -o $$(_d)/$$($(1)_NAME).o $$^
-+	$$(trace-ar) $(AR) crs $$@ $$(_d)/$$($(1)_NAME).o
-+
-+    install: $$($(1)_INSTALL_PATH)
- 
-   endif
- 
-diff --git a/src/libstore/local.mk b/src/libstore/local.mk
-index 8f28bec6c1d..0d41e3c2cac 100644
---- a/src/libstore/local.mk
-+++ b/src/libstore/local.mk
-@@ -69,6 +69,13 @@ $(d)/build.cc:
- 
- clean-files += $(d)/schema.sql.gen.hh $(d)/ca-specific-schema.sql.gen.hh
- 
-+$(d)/nix-store.pc: $(d)/nix-store.pc.in
-+	$(trace-gen) rm -f $@ && ./config.status --quiet --file=$@
-+ifeq ($(BUILD_SHARED_LIBS), 1)
-+	sed -i 's|@LIBS_PRIVATE@||' $@
-+else
-+	sed -i 's|@LIBS_PRIVATE@|Libs.private: $(libstore_LDFLAGS) $(libstore_LDFLAGS_PROPAGATED) $(foreach lib, $(libstore_LIBS), $($(lib)_LDFLAGS))|' $@
-+endif
- $(eval $(call install-file-in, $(d)/nix-store.pc, $(libdir)/pkgconfig, 0644))
- 
- $(foreach i, $(wildcard src/libstore/builtins/*.hh), \
-diff --git a/src/libstore/nix-store.pc.in b/src/libstore/nix-store.pc.in
-index 6d67b1e0380..738991d307b 100644
---- a/src/libstore/nix-store.pc.in
-+++ b/src/libstore/nix-store.pc.in
-@@ -7,3 +7,4 @@ Description: Nix Package Manager
- Version: @PACKAGE_VERSION@
- Libs: -L${libdir} -lnixstore -lnixutil
- Cflags: -I${includedir}/nix -std=c++2a
-+@LIBS_PRIVATE@

package.nix

@@ -1,54 +0,0 @@
-{ lib, stdenv, rustPlatform
-, pkg-config
-, installShellFiles
-, nix
-, boost
-, darwin
-, rust-analyzer
-, clippy
-, rustfmt
-}:
-
-let
-  ignoredPaths = [ ".github" "target" "book" ];
-
-in rustPlatform.buildRustPackage rec {
-  pname = "magic-nix-cache";
-  version = "0.1.0";
-
-  src = lib.cleanSourceWith {
-    filter = name: type: !(type == "directory" && builtins.elem (baseNameOf name) ignoredPaths);
-    src = lib.cleanSource ./.;
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-    installShellFiles
-    rust-analyzer
-    clippy
-    rustfmt
-  ];
-
-  buildInputs = [
-    nix boost
-  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
-    SystemConfiguration
-  ]);
-
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    allowBuiltinFetchGit = true;
-  };
-
-  ATTIC_DISTRIBUTOR = "attic";
-
-  # Hack to fix linking on macOS.
-  NIX_CFLAGS_LINK = lib.optionalString stdenv.isDarwin "-lc++abi";
-
-  # Recursive Nix is not stable yet
-  doCheck = false;
-
-  postFixup = ''
-    rm -f $out/nix-support/propagated-build-inputs
-  '';
-}