rustPlatform.buildRustPackage: lockFile does not escape git branches as expected

[baloo]

Describe the bug

When cargo uses lockfile v4 (rust-lang/cargo#12852), the Cargo.lock will escape the branches names like:

[[package]]
name = "async-signature"
version = "0.6.0-pre.4"
source = "git+https://github.com/baloo/traits.git?branch=baloo%2Fasync-signature%2Fprehash-signer#7eec720f512a8e51710a9c938cbe2af6cf5c5f7b"
dependencies = [
 "signature",
]

This is only displayed when the branch names needs to be escaped (works fine with main/master/etc)

The escape seems to cause the cargo build not to pickup replaced sources correctly.

Steps To Reproduce

A reproducer is available in https://github.com/baloo/cargolock-repro

nix-build should showcase the error.

Expected behavior

Provide the dependency fetched by git to the build

Screenshots

these 2 derivations will be built:
  /nix/store/z8v8wc2rkbbi9sdijf1yjiw6lh7cz100-cargo-vendor-dir.drv
  /nix/store/jkwqs9zd1x78d2i19dqydq8nr4mg9brf-gitlockreproducer.drv
building '/nix/store/z8v8wc2rkbbi9sdijf1yjiw6lh7cz100-cargo-vendor-dir.drv'...
building '/nix/store/jkwqs9zd1x78d2i19dqydq8nr4mg9brf-gitlockreproducer.drv'...
Running phase: unpackPhase
unpacking source archive /nix/store/513bb2xfxhy7ysdgf9vq5n9xwy99bc0a-cargoimport
source root is cargoimport
Executing cargoSetupPostUnpackHook
Finished cargoSetupPostUnpackHook
Running phase: patchPhase
Executing cargoSetupPostPatchHook
Validating consistency between /build/cargoimport/Cargo.lock and /build/cargo-vendor-dir/Cargo.lock
Finished cargoSetupPostPatchHook
Running phase: updateAutotoolsGnuConfigScriptsPhase
Running phase: configurePhase
Running phase: buildPhase
Executing cargoBuildHook
cargoBuildHook flags: -j 16 --target x86_64-unknown-linux-gnu --offline --profile release
error: failed to load source for dependency `async-signature`

Caused by:
  Unable to update https://github.com/baloo/traits.git?branch=baloo%2Fasync-signature%2Fprehash-signer#7eec720f

Caused by:
  can't checkout from 'https://github.com/baloo/traits.git': you are in the offline mode (--offline)

Additional context

Metadata

Notify maintainers

@zowoq @winterqt @figsoda

---

Note for maintainers: Please tag this issue in your PR.

---

Add a 👍 reaction to issues you find important.

[jsoo1]

We ran into this at $WORK recently, thank you for bringing it up.

After some digging we couldn't quite understand which bits of the generated .cargo-config needed changing:

[source."<uri escaped url>"]
# ...
branch = "<uri escaped branch name>"
# ...

was generated but was problematic

[baloo]

[package]
# Force use of lockfile v3
rust-version = "1.82"

In the Cargo.toml seems to be the best workaround available for now. This causes cargo to stick with lockfile v3.

[JohnRTitor]

CC @TomaSajt, perhaps we can handle it from the nix side

[TomaSajt]

Opened a fix for fetchCargoVendor

I do not really want to do the importCargoLock fix, but should be as straightforward as using some kind of bash utility to decode gitParts.value (conditionally)

[jsoo1]

Reproducer in #371795 (comment)

[JohnRTitor]

Fixed in #371795