I’ve started getting 403 errors when attempting to fetch tarballs from crates.io, similar to what’s being described in this pull request. It doesn’t seem that the fix has been backported to the 26.05 channel yet, or if it has, it doesn’t seem to be working correctly.
Do I have to maintain a fork of the channel with the fix for now, or are there other ways to incorporate it into my config?
Hmm, the latest commit on nixos-26.05 has this line:
Could you paste the log with the 403s and info on what commit of Nixpkgs your 26.05 is?
I seem to be on revision 062346a6d85bc4b49dfaa61c986e9c5be21217d1, and a different package fails every time, but here is the log for gix-url, for example:
trying https://crates.io/api/v1/crates/gix-url/0.28.2/download
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (22) The requested URL returned error: 403
error: cannot download gix-url-0.28.2.tar.gz from any mirror
Has my IP just been blocked from downloading anything from their servers, perhaps?
https://crates.io is no longer used by nixpkgs and curl is not used by nixpkgs for fetching Rust packages.
Could you share the nix package or tell us what tools you are using?
As in, what’s attempting to build gix-url? And what tools count? I’m trying to build the top-level config for a system in a mounted store from an ISO using determinate-nix’s nix eval, and several crates packages are failing.
Could the nixpkgs input of another input be causing the problem if it doesn’t have the fix?
cargo2nix was failing, so I disabled it:
pkgs.cargo2nix or inputs.cargo2nix.packages.${system}.default
But even overriding its nixpkgs input (as well as the rust-overlay’s nixpkgs input) didn’t seem to fix it.
Can you find the derivation path for that gix-url derivation and run this (ChatGPT (GPT-5.6-Sol) assisted, but seems to work decently at getting derivation phases/hooks/whatever) script on it?
drv=/nix/store/...-gix-url-0.28.2.drv
nix derivation show "$drv" |
jq -r '
.[].env
| to_entries[]
| select(.value | contains("\n"))
| "===== \(.key) =====\n\(.value)\n"
'
I have a suspicion that fetchCrateAlternativeRegistryExpensive might cause it but IDK.
If you could upload at least flake.lock that might help too.
Sorry for the delay! Busy day. Here is the lockfile, and I’ll run the command and post the output shortly.
And I thought my 1591-line flake.lock was large…
Also, Tangled, nice. Should get some of my repos at least mirrored there. 
1 other question of some importance: do you get some trace of derivations down the dependency chain when gix-url (or others) fail? Could help diagnose what flake input you need to change.
You think that’s bad, wait 'til you hear about my old config… 
And yeah, moved my main stuff there a while back! Convenient for Bluesky users!
I can’t consistently get gix-url to fail, so here’s sha2 instead:
error: Cannot build '/nix/store/9gzqdgc1qrs3nv1815bmkxshswirbhls-sha2-0.10.8.tar.gz.drv'.
Reason: builder failed with exit code 1.
Output paths:
/nix/store/9k9b8prqm41w3kjzrlng2hi5gr4v66m8-sha2-0.10.8.tar.gz
Last 7 log lines:
>
> trying https://crates.io/api/v1/crates/sha2/0.10.8/download
> % Total % Received % Xferd Average Speed Time Time Time Current
> Dload Upload Total Spent Left Speed
> 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
> curl: (22) The requested URL returned error: 403
> error: cannot download sha2-0.10.8.tar.gz from any mirror
For full logs, run:
nix log /nix/store/9gzqdgc1qrs3nv1815bmkxshswirbhls-sha2-0.10.8.tar.gz.drv
error: Cannot build '/nix/store/360fhj9ysw0p6rvfb0j1kiq9kjzyjwkc-tera-1.20.0.tar.gz.drv'.
Reason: builder failed with exit code 1.
Output paths:
/nix/store/41301lw8rgw5zqdak79271xndi349wz8-tera-1.20.0.tar.gz
Last 7 log lines:
>
> trying https://crates.io/api/v1/crates/tera/1.20.0/download
> % Total % Received % Xferd Average Speed Time Time Time Current
> Dload Upload Total Spent Left Speed
> 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
> curl: (22) The requested URL returned error: 403
> error: cannot download tera-1.20.0.tar.gz from any mirror
For full logs, run:
nix log /nix/store/360fhj9ysw0p6rvfb0j1kiq9kjzyjwkc-tera-1.20.0.tar.gz.drv
error: Cannot build '/nix/store/6c6id52v2l18yk40vs5fr1y87cxrsq40-crate-sha2-0.10.8.drv'.
Reason: 1 dependency failed.
Output paths:
/nix/store/7ldlalz6arlnjkrqn0gc1xia05brxkp2-crate-sha2-0.10.8-bin
/nix/store/qr500cl0v01jihhhy4yf6iq1ai7cxvh7-crate-sha2-0.10.8
error: Cannot build '/nix/store/ss69912hjgadj2p7mp1hjcxz0vi7czxf-crate-cargo2nix-0.12.0.drv'.
Reason: 1 dependency failed.
Output paths:
/nix/store/4jh96539xzvc6ii7gs34x56nbjxfysrq-crate-cargo2nix-0.12.0
/nix/store/8mpwi8r3193ag880x2rlb7v4nj50xw1f-crate-cargo2nix-0.12.0-bin
error: Cannot build '/nix/store/3skrvwvb63r7rksjpdkjp0jb78wwiwmv-cargo2nix_fish-completions.drv'.
Reason: 1 dependency failed.
Output paths:
/nix/store/1zz29m1q1wfgp7p34zikfalrlgprxma9-cargo2nix_fish-completions
error: Cannot build '/nix/store/zf2h97z5c6zrrhr1180m2w7y43rqvg1p-man-paths.drv'.
Reason: 1 dependency failed.
Output paths:
/nix/store/aggbmfpdhqw43v6qgznlwmvbrw381khs-man-paths
error: Cannot build '/nix/store/4m17anqb7108ya5jv765x7fza9ahwr87-system-path.drv'.
Reason: 1 dependency failed.
Output paths:
/nix/store/ix4cm1ywg0jnvd84cdzvpdfxk1qbcmaa-system-path
❌ git+file:///mnt/home/syvlorg/nixos#ncs.pegasus.config.system.build.toplevel
error: Cannot build '/nix/store/fv11i2lmambwpk4bajax5sjciv1pyqak-nixos-system-pegasus-26.05.20251130.e953753.drv'.
Reason: 1 dependency failed.
Output paths:
/nix/store/kxrahmvg1djjpzaj3qxwax4q0hgzykl9-nixos-system-pegasus-26.05.20251130.e953753
OK so it is being built as a dependency of cargo2nix, not as a different cargo2nix-generated derivation.
pkgs.cargo2nix does not exist as cargo2nix is not packaged in nixpkgs. Follow the cargo2nix nixpkgs input. That kind of messed me up as I was expecting it to exist.
Also just FYI I use crate2nix instead of cargo2nix for my projects, depending on why you need cargo2nix that might interesting to look itno.
Also you might want to look into flint or flat-flake to give follow suggestions if you want that.
Is that not what I’m doing with this line?
pkgs.cargo2nix or inputs.cargo2nix.packages.${system}.default
And thanks for the heads up! I’ll look into switching to it.
Yes, but as I said that only works if cargo2nix is actually in nixpkgs, which does not seem to be the case.
cargo2nix is currently using release-23.11 (cargo2nix/flake.nix at a709c74619e1a2b68ed12bb398e12fbe29d69657 · cargo2nix/cargo2nix · GitHub) and which is no longer supported (nobody should be using the release-* branches outside of developing nixpkgs anyway).
Yeah, so inputs.cargo2nix is used, is it not, thanks to the or keyword? I’m kinda trying to future-proof it so I don’t forget in the future! 
I have a terrible memory…
But wouldn’t overriding its nixpkgs input then solve the 403 errors?
Yep. if the first thing is missing then or will use the second.
It should.
BTW, follows doesn’t care too much, you can follow something to another completely different flake, it would just probably fail to eval (some exceptions, overriding nixpkgs-lib to nixpkgs is generally safe, for example).
Sorry, little confused by this comment; would the following work, then?
cargo2nix = {
url = "github:cargo2nix/cargo2nix";
inputs.nixpkgs.follows = "nixpkgs";
inputs.rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
};
I tried this, but it still doesn’t seem to work, even after updating all the inputs.
This may be an XY problem – what are you actually trying to achieve with your config? Is cargo2nix the goal or a means to an end?