[nix] Hack to use vendored deps in shell

This has to materialise a number of .cargo/config.toml into the tree
in order to point Cargo at the Nix-vendored deps. Ideally, the cargo
wrapper script would just pass some config information, but
unfortunately, due to rust-lang/cargo#11031,
external subcommands do not respect --config and will only pick up
configuration that's actually in .cargo/config.toml files in the tree.

In order to reduce the risk of these getting improperly committed to
the repository, the script also adds them to .git/info/exclude
whenever it creates them.

Signed-off-by: Lucy Menon <168595099+syntactically@users.noreply.github.com>

Author: syntactically

flake.nix

@@ -96,38 +96,81 @@
             rustc = toolchains.stable.rust;
           };
 
+          # Script snippet, used in the cargo/rustc wrappers below,
+          # which creates a number of .cargo/config.toml files in
+          # order to allow using Nix-fetched dependencies (this must
+          # be done for the guests, as well as for the main
+          # workspace).  Ideally, we would just use environment
+          # variables or the --config option to Cargo, but
+          # unfortunately that tends not to play well with subcommands
+          # like `cargo clippy` and `cargo hyperlight` (see
+          # https://github.com/rust-lang/cargo/issues/11031).
+          materialiseDeps = deps: let
+            sortedNames =  lib.lists.reverseList (builtins.attrNames deps);
+            matchClause = path: ''  */${path}) root="''${manifest%${path}}" ;;'';
+            matchClauses = lib.strings.concatStringsSep "\n"
+              (builtins.map matchClause sortedNames);
+            makeClause = manifest: vendor: let
+              dir = builtins.dirOf manifest;
+              gitExclude = builtins.toString (/. + "${dir}/.cargo");
+            in ''
+              mkdir -p $root/${dir}/.cargo
+              cat >$root/${dir}/.cargo/config.toml <<EOF
+              [source.crates-io]
+              replace-with = "vendored-sources"
+
+              [source.vendored-sources]
+              directory = "${vendor}"
+              EOF
+              printf "# vendor dependency configuration generated by nix\n%s\n" "${gitExclude}" >> $root/.git/info/exclude
+            '';
+            makeClauses = lib.strings.concatStringsSep "\n"
+              (lib.mapAttrsToList makeClause deps);
+          in ''
+            manifest=$(''${base}/bin/cargo locate-project --message-format plain --workspace)
+            case "$manifest" in
+              ${matchClauses}
+            esac
+            if [ -f ''${root}/flake.nix ]; then
+              sed -i '/# vendor dependency configuration generated by nix/{N;d;}' $root/.git/info/exclude
+              ${makeClauses}
+            fi
+          '';
+
           # Hyperlight scripts use cargo in a bunch of ways that don't
           # make sense for Nix cargo, including the `rustup +toolchain`
           # syntax to use a specific toolchain and `cargo install`, so we
           # build wrappers for rustc and cargo that enable this.  The
           # scripts also use `rustup toolchain install` in some cases, in
           # order to work in CI, so we provide a fake rustup that does
           # nothing as well.
-          rustup-like-wrapper = name: pkgs.writeShellScriptBin name
+          rustup-like-wrapper = name: deps: pkgs.writeShellScriptBin name
             (let
               clause = name: toolchain:
                 "+${name}) base=\"${toolchain.rust}\"; shift 1; ;;";
               clauses = lib.strings.concatStringsSep "\n"
                 (lib.mapAttrsToList clause toolchains);
             in ''
               base="${toolchains.stable.rust}"
+              ${materialiseDeps deps}
               case "$1" in
                 ${clauses}
                 install) exit 0; ;;
               esac
               export PATH="$base/bin:$PATH"
               exec "$base/bin/${name}" "$@"
             '');
-          fake-rustup = pkgs.symlinkJoin {
+          fake-rustup = deps: pkgs.symlinkJoin {
             name = "fake-rustup";
             paths = [
               (pkgs.writeShellScriptBin "rustup" "")
-              (rustup-like-wrapper "rustc")
-              (rustup-like-wrapper "cargo")
+              (rustup-like-wrapper "rustc" deps)
+              (rustup-like-wrapper "cargo" deps)
             ];
           };
 
           buildRustPackageClang = rust-platform.buildRustPackage.override { stdenv = clangStdenv; };
+
           cargo-hyperlight = buildRustPackageClang rec {
             pname = "cargo-hyperlight";
             version = "0.1.5";
@@ -139,6 +182,29 @@
             };
             cargoHash = "sha256-muiMVrK1TydQiMitihfo7xYidqUIIQ+Hw3BIeo5rLFw=";
           };
+          # when building a guest with cargo-hyperlight, we need to
+          # include any crates.io dependencies of the standard library
+          # (e.g. rustc-literal-escaper)
+          stdlibLocks = lib.mapAttrsToList (_: toolchain:
+            "${toolchain.rust}/lib/rustlib/src/rust/library/Cargo.lock"
+          ) toolchains;
+          stdlibDeps = builtins.map (lockFile:
+            rust-platform.importCargoLock { inherit lockFile; }) stdlibLocks;
+          withStdlibLock = lockFile:
+            pkgs.symlinkJoin {
+              name = "cargo-deps";
+              paths = stdlibDeps ++ [
+                (rust-platform.importCargoLock {
+                  inherit lockFile;
+                })
+              ];
+            };
+          deps = finalRootVendor: {
+            "Cargo.toml" = finalRootVendor;
+            "src/tests/rust_guests/dummyguest/Cargo.toml" = withStdlibLock ./src/tests/rust_guests/dummyguest/Cargo.lock;
+            "src/tests/rust_guests/simpleguest/Cargo.toml" = withStdlibLock ./src/tests/rust_guests/simpleguest/Cargo.lock;
+            "src/tests/rust_guests/witguest/Cargo.toml" = withStdlibLock ./src/tests/rust_guests/witguest/Cargo.lock;
+          };
         in (buildRustPackageClang (mkDerivationAttrs: {
           pname = "hyperlight";
           version = "0.0.0";
@@ -179,7 +245,7 @@
           # Set this through shellHook rather than nativeBuildInputs to be
           # really sure that it overrides the real cargo.
           postHook = ''
-            export PATH="${fake-rustup}/bin:$PATH"
+            export PATH="${fake-rustup (deps mkDerivationAttrs.cargoDeps)}/bin:$PATH"
           '';
         })).overrideAttrs(oA: {
           hardeningDisable = [ "all" ];