allow to pass outputHashes to crane

[Mic92]

This makes it possible to evaluate crane in a nixos test without network
as well as allow to backup all fetched input derivations properly in a
binary cache, whereas fetchGit will fallback to downloading from a
repository, which also requires a git binary to be present.

Motivation

Checklist

• added tests to verify new behavior
• added an example template or updated an existing one
• updated docs/API.md (or general documentation) with changes
• updated CHANGELOG.md

[Mic92]

If you agree on the idea I can work on tests/docs for this.

[Mic92]

Currently this is what the api looks like:

  cargoArtifacts = craneLib.buildDepsOnly {
   inherit src buildInputs nativeBuildInputs cargoExtraArgs;
   outputHashes = {
     "https://github.com/youruser/yourrepo?rev=4c220d364c53138d7dc37c6c95fee4b9f2efdc77" = "sha256-6DrNnzy2jYpkxiNReAkUl22Iz6au0+kmePmTXQxUsug=";
   };
 };

[ipetkov]

Thanks for looking into this @Mic92! I had assumed that builtins.fetchGit would work offline since we already specify a git revision, but I suppose Nix wants to use its own hash of the content itself and not the git hash 🤦‍♂️

Anyway I'm definitely open to including this (modulo adding tests and docs, but I can also help flesh those out as needed)!

Thinking from a broader API perspective it would be cool to allow dropping some kind of crane-git-hashes.json file next to Cargo.lock and having it automatically be picked up during vendoring so that consumers don't have to manually plumb through a custom vendorCargoDeps invocation. Though we can and should do that in a separate PR, we can focus on the lower level API changes fist

[Mic92]

Thinking from a broader API perspective it would be cool to allow dropping some kind of crane-git-hashes.json file next to Cargo.lock and having it automatically be picked up during vendoring so that consumers don't have to manually plumb through a custom vendorCargoDeps invocation. Though we can and should do that in a separate PR, we can focus on the lower level API changes fist

Yes. Let's keep this simple. Json is probably also something consumers wouldn't want to write by hand.

[ipetkov]

Thanks for addressing the feedback @Mic92, looking good!

I added a simple test case, and I also changed the key format of outputHashes to use the value of the package's source attribute in Cargo.lock. This version is actually unique since it includes the commit revision and makes it plainly obvious which hash maps to what entry in Cargo.lock if someone has to debug mismatched hashes! This should also make it a bit easier to write some kind of script/tool which can automatically generate output hashes from a Cargo.lock file but we can work on this afterwards.

The last bits to take care of before merging is to update the CHANGELOG and add some documentation around the change. Feel free to take a shot at that, but if not I'll come back to it later!