Differences between using a local copy of a lib and fetching from git

[4JX]

So far I've been manually downloading and copying a few dependencies from another project (namely hbb_common and scrap since I didn't quite realize cargo could automagically find them if I appended the whole git repo as a dependency and just changed the name to the one I need.

The issue is that hbb_common creates files via its build.rs here that it then uses in its code. This step seems to be resolved just fine if I manually copy them over to my repo, but fails to build if used as a git dependency via scrap = { git = "https://github.com/rustdesk/rustdesk.git", rev = "878111f" } with the error

legion-kb-rgb-deps>    Compiling hbb_common v0.1.0 (https://github.com/rustdesk/rustdesk.git?rev=878111f#878111f3)
legion-kb-rgb-deps> error: failed to run custom build command for `hbb_common v0.1.0 (https://github.com/rustdesk/rustdesk.git?rev=878111f#878111f3)`
legion-kb-rgb-deps> Caused by:
legion-kb-rgb-deps>   process didn't exit successfully: `/build/source/target/release/build/hbb_common-8669468aaa10f548/build-script-build` (exit status: 101)
legion-kb-rgb-deps>   --- stderr
legion-kb-rgb-deps>   thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: Os { code: 13, kind: PermissionDenied, message: "Permission denied" }', /nix/store/g35mmz48v1ls7mvg95yf42gsyy04b41b-vendor-cargo-deps/f3ba987e76f5c5bfe7b40cf2f3ab63e922bdff676ab9e74fe7dd87c06e905331/hbb_common-0.1.0/build.rs:2:43

I'm pretty sure this is related to the recent discussion about unfriendly dependencies, but I'm curious as to why going the manual-copy route would not have the same issue present when using the git repo.

[ipetkov]

Nix builds derivations in a writable sandbox. This is where the derivation's source is copied to, and presumably where other operations such as applying patches or running other scripts on the source. When you copy other crates into your own source directory (also sometimes called local vendoring) those files make it to the same writable directory and why the build script can happily write to src/protos.

When crates are pulled in via Cargo.toml (whether they come from crates.io or a git repository) they are vendored into the Nix store which is readonly. So you are correct, this issue is because the build script is trying to write into the directory of where its sources are contained. (If you build that crate outside of Nix it might happen to work properly because cargo won't sandbox the ~/.cargo directory on disk...)

The best course of action is to update that build script to write to $OUT_DIR and update the imports accordingly. Hope this helps!