Retire vendor/jostoph-rs for the midgard mirror #3

New issue

Closed

opened 2026-08-10 08:06:53 +00:00 by agent.teyla · 0 comments

agent.teyla commented

2026-08-10 08:06:53 +00:00

Collaborator

PR #2 landed vendor/jostoph-rs — 21 files of the substrate copied into this repository — and said plainly that it was not the answer:

Provisional: jostoph-rs is now vendor/jostoph-rs, a path dependency instead of a git one. jo.et0.pw is private, and Nix's sandboxed fixed-output git fetch has no credentials to reach it with... The real distribution model — deploy key, making jostoph-rs public, a shared-library host under Ting/, sourcehut as canonical upstream — is still undecided (owner, 2026-08-09). This unblocks the ticket without deciding between them; bump by re-copying vendor/jostoph-rs from a fresh clone at the new rev.

That decision has since been made, in Ting/Jostoph#3: development on lar.ad/<repo>, public consumption on midgard/<repo> over anonymous HTTPS, and it names jostoph-rs as bound for midgard. midgard/jostoph-rs now exists and its main is 029a102cf606 — the exact rev vendored here.

So the credential problem that forced the vendoring is gone, and the copy can go with it.

In scope

A jostoph-rs flake input at git+https://jo.et0.pw/midgard/jostoph-rs.git, flake = false.
vendor/jostoph-rs deleted from the tree and materialized from that input instead — postPatch for the package, the devShell's shellHook for a working tree.
/vendor gitignored.

Out of scope

A substrate bump. midgard main is the rev already vendored; this must be content-identical, and that is checkable.
A Cargo git dependency. Staying a path dependency keeps Cargo.lock untouched, needs no outputHashes, and keeps the sandboxed build credential-free. The pin moves to flake.lock, where nix flake update jostoph-rs bumps it deliberately.
.fastlane.toml. midgard/jostoph-rs is main-only by design (owner, 2026-08-10) — the substrate is consumed as published, not co-developed branch-for-branch with this service, so it is not a manifest input.
Anything the service does. No behaviour change; this is where the source comes from.

Boundary

The build stops reading files in this repository and starts following a repository whose freshness nothing yet reconciles — Ting/Jostoph#3's push mirror is still hand-configured. That is acceptable only because flake.lock records an exact rev: a stale mirror cannot silently change what this builds, it can only delay what a future nix flake update finds.

Deleting 21 tracked files is not reversible by a consumer who has already fetched them, so the equality of the two trees has to be established before the deletion, not asserted after.

Acceptance

The mirror's tree and vendor/jostoph-rs are byte-identical, verified by diff before anything is deleted.
flake.lock resolves jostoph-rs to 029a102cf6065ef3cd561b06bae613fb2ff0bbb2 — proving repoint, not bump.
Cargo.lock is unchanged.
nix build .#default produces a working bin/vedanta.
cargo test and cargo clippy --all-targets -- -D warnings are clean in the devShell, compiling jostoph from the materialized path.

Context

PR #2 — the provisional vendoring this retires, and its own instruction to "bump by re-copying," which this removes the need for.
Ting/Jostoph#3 — the lar.ad/midgard publish pattern that made this possible.
Ting/Jostoph#12 / Ting/Jostoph#13 — the same swap in the steward, which additionally unblocks its missing flake.lock.

PR #2 landed `vendor/jostoph-rs` — 21 files of the substrate copied into this repository — and said plainly that it was not the answer: > **Provisional**: `jostoph-rs` is now `vendor/jostoph-rs`, a path dependency instead of a git one. `jo.et0.pw` is private, and Nix's sandboxed fixed-output git fetch has no credentials to reach it with... The real distribution model — deploy key, making `jostoph-rs` public, a shared-library host under `Ting/`, sourcehut as canonical upstream — is still undecided (owner, 2026-08-09). This unblocks the ticket without deciding between them; bump by re-copying `vendor/jostoph-rs` from a fresh clone at the new rev. That decision has since been made, in `Ting/Jostoph#3`: **development on `lar.ad/<repo>`, public consumption on `midgard/<repo>` over anonymous HTTPS**, and it names `jostoph-rs` as bound for midgard. `midgard/jostoph-rs` now exists and its `main` is `029a102cf606` — the exact rev vendored here. So the credential problem that forced the vendoring is gone, and the copy can go with it. ## In scope - A `jostoph-rs` flake input at `git+https://jo.et0.pw/midgard/jostoph-rs.git`, `flake = false`. - `vendor/jostoph-rs` deleted from the tree and materialized from that input instead — `postPatch` for the package, the devShell's `shellHook` for a working tree. - `/vendor` gitignored. ## Out of scope - **A substrate bump.** midgard `main` is the rev already vendored; this must be content-identical, and that is checkable. - **A Cargo `git` dependency.** Staying a path dependency keeps `Cargo.lock` untouched, needs no `outputHashes`, and keeps the sandboxed build credential-free. The pin moves to `flake.lock`, where `nix flake update jostoph-rs` bumps it deliberately. - **`.fastlane.toml`.** midgard/jostoph-rs is `main`-only by design (owner, 2026-08-10) — the substrate is consumed as published, not co-developed branch-for-branch with this service, so it is not a manifest input. - **Anything the service does.** No behaviour change; this is where the source comes from. ## Boundary The build stops reading files in this repository and starts following a repository whose freshness nothing yet reconciles — `Ting/Jostoph#3`'s push mirror is still hand-configured. That is acceptable only because `flake.lock` records an exact rev: a stale mirror cannot silently change what this builds, it can only delay what a future `nix flake update` finds. Deleting 21 tracked files is not reversible by a consumer who has already fetched them, so the equality of the two trees has to be established before the deletion, not asserted after. ## Acceptance - The mirror's tree and `vendor/jostoph-rs` are byte-identical, verified by diff before anything is deleted. - `flake.lock` resolves `jostoph-rs` to `029a102cf6065ef3cd561b06bae613fb2ff0bbb2` — proving repoint, not bump. - `Cargo.lock` is unchanged. - `nix build .#default` produces a working `bin/vedanta`. - `cargo test` and `cargo clippy --all-targets -- -D warnings` are clean in the devShell, compiling `jostoph` from the materialized path. ## Context - PR #2 — the provisional vendoring this retires, and its own instruction to "bump by re-copying," which this removes the need for. - `Ting/Jostoph#3` — the `lar.ad`/`midgard` publish pattern that made this possible. - `Ting/Jostoph#12` / `Ting/Jostoph#13` — the same swap in the steward, which additionally unblocks its missing `flake.lock`.

agent.teyla referenced this issue from a pull request that will close it,

2026-08-10 08:08:30 +00:00

Retire vendor/jostoph-rs for the midgard mirror #4