Skip to content

fix(l2): override Nix daemon User-Agent so crates.io stops 403ing the TDX image build #6739

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ilitteri merged 3 commits into from
May 27, 2026
Merged

fix(l2): override Nix daemon User-Agent so crates.io stops 403ing the TDX image build #6739

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c125c8d
fix(l2): set Nix fetchurl User-Agent so crates.io stops 403ing the TD…
ilitteri May 27, 2026
0e0663d
fix(l2): inject crates.io-friendly User-Agent into the Nix daemon, no…
ilitteri May 27, 2026
3e5f680
fix(l2): use curl glued -A form for the crates.io User-Agent override
ilitteri May 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 11 additions & 2 deletions crates/l2/tee/quote-gen/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,22 @@ NIXPKGS_URL = https://github.com/NixOS/nixpkgs/archive/3fcbdcfc707e0aa42c541b774
GIT_REV := $(shell git rev-parse --short=7 HEAD)
NIX_BUILD_ARGS = --no-out-link -I nixpkgs=$(NIXPKGS_URL) --argstr gitRev "$(GIT_REV)"

# crates.io returns HTTP 403 for any User-Agent containing "curl/", which is what
# Nix's fetchurl sends by default (`curl/<ver> Nixpkgs/<ver>`). That breaks every
# crate download during the image build. fetchurl appends $NIX_CURL_FLAGS to its
# curl invocation (last --user-agent wins) and passes it into the fixed-output
# derivation sandbox via impureEnvVars, so we override the User-Agent with one
# crates.io accepts. Set inline on the nix-build command rather than via `export`
# because GNU Make's $(shell ...) does not inherit exported variables.
NIX_ENV = NIX_CURL_FLAGS="--user-agent ethrex-ci+https://github.com/lambdaclass/ethrex"

image.raw:
$(eval IMAGE := $(shell nix-build image.nix ${NIX_BUILD_ARGS})/${IMAGE_NAME})
$(eval IMAGE := $(shell $(NIX_ENV) nix-build image.nix ${NIX_BUILD_ARGS})/${IMAGE_NAME})
cp $(IMAGE) image.raw
chmod u+rw image.raw

run: image.raw
$(eval RUN_QEMU := $(shell nix-build hypervisor.nix ${NIX_BUILD_ARGS})/bin/run-qemu)
$(eval RUN_QEMU := $(shell $(NIX_ENV) nix-build hypervisor.nix ${NIX_BUILD_ARGS})/bin/run-qemu)
$(RUN_QEMU) image.raw

clean:
Expand Down
Loading