chore(3p/sources): bump to OpenSSH vulnerability hotfix r/8337

See https://github.com/NixOS/nixpkgs/pull/323753 for details.

Changes:

* git: temporarily comment out dottime patch (it doesn't apply, but it's not critical)
* third-party/cgit: use an older git version where dottime patch still applies
* 3p/crate2nix: remove crate2nix patches included in latest release
* tvix: remove unneeded defaultCrateOverrides (upstreamed to nixpkgs)
* tvix: regenerate Cargo.nix
* tvix/nix-compat: remove unnused AtermWriteable::aterm_bytes pub(crate) function
* tvix/nix-compat: remove redundant trait bounds
* tvix/glue: use clone_into() to set drv.{builder,system}
* tools/crate2nix: apply workaround for https://github.com/numtide/treefmt/issues/327
* toold/depotfmt: expose treefmt config as passthru
* tools/crate2nix: undo some more hacks in the crate2nix-check drv

Change-Id: Ifbcedeb3e8f81b2f6ec1dbf10189bfa6dfd9c75c
Co-Authored-By: Florian Klink <flokli@flokli.de>
Reviewed-on: https://cl.tvl.fyi/c/depot/+/11907
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
Reviewed-by: flokli <flokli@flokli.de>

15 files changed, 124 insertions, 230 deletions

diff --git a/.nixery/default.nix b/.nixery/default.nix
index 19da286ee345..5a3325ea796c 100644
--- a/.nixery/default.nix
+++ b/.nixery/default.nix
@@ -1,6 +1,6 @@
 # See README.md
-{ depot ? import ../. {}, ... }:
+{ depot ? import ../. { }, ... }:
 
-depot.third_party.nixpkgs.extend(_: _: {
+depot.third_party.nixpkgs.extend (_: _: {
   tvl = depot;
 })
diff --git a/third_party/cgit/default.nix b/third_party/cgit/default.nix
index c783bda16ed2..bac6a3264e6e 100644
--- a/third_party/cgit/default.nix
+++ b/third_party/cgit/default.nix
@@ -27,12 +27,25 @@ stdenv.mkDerivation rec {
   #
   # TODO(tazjin): Add an assert for this somewhere so we notice it on
   # channel bumps.
-  preBuild = ''
-    rm -rf git # remove submodule dir ...
-    cp -r --no-preserve=ownership,mode ${pkgs.srcOnly depot.third_party.git} git
-    makeFlagsArray+=(prefix="$out" CGIT_SCRIPT_PATH="$out/cgit/")
-    cat tvl-extra.css >> cgit.css
-  '';
+  preBuild =
+    let
+      # we have to give cgit a git with dottime support to build
+      git' = pkgs.git.overrideAttrs (old: {
+        src = pkgs.fetchurl {
+          url = "https://github.com/git/git/archive/refs/tags/v2.44.2.tar.gz";
+          hash = "sha256-3h0LBfAD4MXfZc0tjWQDO81UdbRo3w5C0W7j7rr9m9I=";
+        };
+        patches = (old.patches or [ ]) ++ [
+          ../git/0001-feat-third_party-git-date-add-dottime-format.patch
+        ];
+      });
+    in
+    ''
+      rm -rf git # remove submodule dir ...
+      cp -r --no-preserve=ownership,mode ${pkgs.srcOnly git'} git
+      makeFlagsArray+=(prefix="$out" CGIT_SCRIPT_PATH="$out/cgit/")
+      cat tvl-extra.css >> cgit.css
+    '';
 
   stripDebugList = [ "cgit" ];
 
diff --git a/third_party/git/default.nix b/third_party/git/default.nix
index eed07b5616c6..19613fd69555 100644
--- a/third_party/git/default.nix
+++ b/third_party/git/default.nix
@@ -4,6 +4,6 @@
 
 pkgs.git.overrideAttrs (old: {
   patches = (old.patches or [ ]) ++ [
-    ./0001-feat-third_party-git-date-add-dottime-format.patch
+    # ./0001-feat-third_party-git-date-add-dottime-format.patch
   ];
 })
diff --git a/third_party/overlays/patches/crate2nix-drop-darwin-explicit-dontstrip.patch b/third_party/overlays/patches/crate2nix-drop-darwin-explicit-dontstrip.patch
deleted file mode 100644
index ba64e660c0e3..000000000000
--- a/third_party/overlays/patches/crate2nix-drop-darwin-explicit-dontstrip.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From 0209f258cda8a9972a785e26d92fb477ce4d1b0e Mon Sep 17 00:00:00 2001
-From: Ilan Joselevich <personal@ilanjoselevich.com>
-Date: Tue, 11 Jun 2024 18:14:06 +0300
-Subject: [PATCH] Get rid of dontStrip for Darwin as it's no longer needed
-
-Fixed in https://github.com/NixOS/nixpkgs/pull/255900
----
- templates/nix/crate2nix/default.nix                  | 2 --
-
-diff --git a/templates/nix/crate2nix/default.nix b/templates/nix/crate2nix/default.nix
-index 95d3730f..c53925e7 100644
---- a/templates/nix/crate2nix/default.nix
-+++ b/templates/nix/crate2nix/default.nix
-@@ -349,8 +349,6 @@ rec {
-           buildRustCrateForPkgsFunc pkgs
-             (
-               crateConfig // {
--                # https://github.com/NixOS/nixpkgs/issues/218712
--                dontStrip = stdenv.hostPlatform.isDarwin;
-                 src = crateConfig.src or (
-                   pkgs.fetchurl rec {
-                     name = "${crateConfig.crateName}-${crateConfig.version}.tar.gz";
diff --git a/third_party/overlays/patches/crate2nix-run-tests-in-build-source.patch b/third_party/overlays/patches/crate2nix-run-tests-in-build-source.patch
deleted file mode 100644
index 52793270e6e8..000000000000
--- a/third_party/overlays/patches/crate2nix-run-tests-in-build-source.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 7cf084f73f7d15fe0538a625182fa7179c083b3d Mon Sep 17 00:00:00 2001
-From: Raito Bezarius <masterancpp@gmail.com>
-Date: Tue, 16 Jan 2024 02:10:48 +0100
-Subject: [PATCH] fix(template): run tests in `/build/source` instead `/build`
-
-Previously, the source tree was located inline in `/build` during tests, this was a mistake
-because the crates more than often are built in `/build/source` as per the `sourceRoot` system.
-
-This can cause issues with test binaries hardcoding `/build/source/...` as their choice for doing things,
-causing them to be confused in the test phase which is relocated without rewriting the paths inside test binaries.
-
-We fix that by relocating ourselves in the right hierarchy.
-
-This is a "simple" fix in the sense that more edge cases could exist but they are hard to reason about
-because they would be crates using custom `sourceRoot`, i.e. having `crate.sourceRoot` set and then it becomes
-a bit hard to reproduce the hierarchy, you need to analyze whether the path is absolute or relative,
-
-If it's relative, you can just reuse it and reproduce that specific hierarchy.
-If it's absolute, you need to cut the "absolute" meaningless part, e.g. `$NIX_BUILD_TOP/` and proceed like
-it's a relative path IMHO.
----
- crate2nix/Cargo.nix                                  | 10 ++++++++++
- crate2nix/templates/nix/crate2nix/default.nix        | 10 ++++++++++
-
-diff --git a/Cargo.nix b/Cargo.nix
-index 6ef7a49..172ff34 100644
---- a/Cargo.nix
-+++ b/Cargo.nix
-@@ -2889,6 +2889,16 @@ rec {
-           # recreate a file hierarchy as when running tests with cargo
- 
-           # the source for test data
-+          # It's necessary to locate the source in $NIX_BUILD_TOP/source/
-+          # instead of $NIX_BUILD_TOP/
-+          # because we compiled those test binaries in the former and not the latter.
-+          # So all paths will expect source tree to be there and not in the build top directly.
-+          # For example: $NIX_BUILD_TOP := /build in general, if you ask yourself.
-+          # TODO(raitobezarius): I believe there could be more edge cases if `crate.sourceRoot`
-+          # do exist but it's very hard to reason about them, so let's wait until the first bug report.
-+          mkdir -p source/
-+          cd source/
-+
-           ${pkgs.buildPackages.xorg.lndir}/bin/lndir ${crate.src}
- 
-           # build outputs
-diff --git a/crate2nix/templates/nix/crate2nix/default.nix b/crate2nix/templates/nix/crate2nix/default.nix
-index e4fc2e9..dfb14c4 100644
---- a/templates/nix/crate2nix/default.nix
-+++ b/templates/nix/crate2nix/default.nix
-@@ -135,6 +135,16 @@ rec {
-           # recreate a file hierarchy as when running tests with cargo
- 
-           # the source for test data
-+          # It's necessary to locate the source in $NIX_BUILD_TOP/source/
-+          # instead of $NIX_BUILD_TOP/
-+          # because we compiled those test binaries in the former and not the latter.
-+          # So all paths will expect source tree to be there and not in the build top directly.
-+          # For example: $NIX_BUILD_TOP := /build in general, if you ask yourself.
-+          # TODO(raitobezarius): I believe there could be more edge cases if `crate.sourceRoot`
-+          # do exist but it's very hard to reason about them, so let's wait until the first bug report.
-+          mkdir -p source/
-+          cd source/
-+
-           ${pkgs.buildPackages.xorg.lndir}/bin/lndir ${crate.src}
- 
-           # build outputs
--- 
-2.43.0
-
diff --git a/third_party/overlays/patches/treefmt-fix-no-cache.patch b/third_party/overlays/patches/treefmt-fix-no-cache.patch
new file mode 100644
index 000000000000..2ad9d595e106
--- /dev/null
+++ b/third_party/overlays/patches/treefmt-fix-no-cache.patch
@@ -0,0 +1,43 @@
+From 601af097720079ea40db100b1dd6aefba4685e7c Mon Sep 17 00:00:00 2001
+From: Florian Klink <flokli@flokli.de>
+Date: Mon, 1 Jul 2024 17:34:08 +0300
+Subject: [PATCH] fix: only try opening the cache if cache is enabled
+
+Otherwise `--no-cache` still fails to open the cache.
+---
+ cli/format.go | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/cli/format.go b/cli/format.go
+index 492a4f3..8ccf578 100644
+--- a/cli/format.go
++++ b/cli/format.go
+@@ -118,9 +118,11 @@ func (f *Format) Run() (err error) {
+ 		f.formatters[name] = formatter
+ 	}
+ 
+-	// open the cache
+-	if err = cache.Open(f.TreeRoot, f.ClearCache, f.formatters); err != nil {
+-		return err
++	// open the cache if configured
++	if !f.NoCache {
++		if cache.Open(f.TreeRoot, f.ClearCache, f.formatters); err != nil {
++			return err
++		}
+ 	}
+ 
+ 	// create an app context and listen for shutdown
+@@ -148,7 +150,9 @@ func (f *Format) Run() (err error) {
+ 	f.processedCh = make(chan *walk.File, cap(f.filesCh))
+ 
+ 	// start concurrent processing tasks in reverse order
+-	eg.Go(f.updateCache(ctx))
++	if !f.NoCache {
++		eg.Go(f.updateCache(ctx))
++	}
+ 	eg.Go(f.applyFormatters(ctx))
+ 	eg.Go(f.walkFilesystem(ctx))
+ 
+-- 
+2.44.1
+
diff --git a/third_party/overlays/tvl.nix b/third_party/overlays/tvl.nix
index f2260be8b8fb..6aba5480b205 100644
--- a/third_party/overlays/tvl.nix
+++ b/third_party/overlays/tvl.nix
@@ -101,8 +101,6 @@ depot.nix.readTree.drvTargets {
     patches = old.patches or [ ] ++ [
       # https://github.com/nix-community/crate2nix/pull/301
       ./patches/crate2nix-tests-debug.patch
-      # TODO(Kranzes): drop on next release
-      ./patches/crate2nix-drop-darwin-explicit-dontstrip.patch
     ];
   });
 
@@ -135,4 +133,9 @@ depot.nix.readTree.drvTargets {
             hash = "sha256-ucTzO2qdN4QkowMVvC3+4pjEVjbwMsB0xFk+bvQxwtQ=";
           };
         }) else super.fuse;
+
+  treefmt = super.treefmt.overrideAttrs (old: {
+    # https://github.com/numtide/treefmt/pull/328
+    patches = old.patches or [ ] ++ [ ./patches/treefmt-fix-no-cache.patch ];
+  });
 }
diff --git a/third_party/sources/sources.json b/third_party/sources/sources.json
index 8844eddc9c15..9406d02c86f1 100644
--- a/third_party/sources/sources.json
+++ b/third_party/sources/sources.json
@@ -65,10 +65,10 @@
         "homepage": "",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "051f920625ab5aabe37c920346e3e69d7d34400e",
-        "sha256": "08lin51g5x2vv89rs6vmqxnyy8pfysh0wdp6mdxw6l86dpm2rbg2",
+        "rev": "7f993cdf26ccef564eabf31fdb40d140821e12bc",
+        "sha256": "0dypbvibfdmv14rqlamf451625fw2fyk11prw9bbywi0q2i313d5",
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/051f920625ab5aabe37c920346e3e69d7d34400e.tar.gz",
+        "url": "https://github.com/NixOS/nixpkgs/archive/7f993cdf26ccef564eabf31fdb40d140821e12bc.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
     "nixpkgs-stable": {
diff --git a/tools/depotfmt.nix b/tools/depotfmt.nix
index 706b7c05a5a4..a1caab0e210e 100644
--- a/tools/depotfmt.nix
+++ b/tools/depotfmt.nix
@@ -37,20 +37,23 @@ let
   # helper tool for formatting the depot interactively
   depotfmt = pkgs.writeShellScriptBin "depotfmt" ''
     exec ${pkgs.treefmt}/bin/treefmt ''${@} \
-      --config-file ${config} \
+      --on-unmatched=debug \
+      --config-file=${config} \
       --tree-root $(${pkgs.git}/bin/git rev-parse --show-toplevel)
   '';
 
   # wrapper script for running formatting checks in CI
   check = pkgs.writeShellScript "depotfmt-check" ''
     ${pkgs.treefmt}/bin/treefmt \
-      --clear-cache \
+      --no-cache \
+      --on-unmatched=debug \
       --fail-on-change \
-      --config-file ${config} \
-      --tree-root .
+      --config-file=${config} \
+      --tree-root=.
   '';
 in
 depotfmt.overrideAttrs (_: {
+  passthru.config = config;
   passthru.meta.ci.extraSteps.check = {
     label = "depot formatting check";
     command = check;
diff --git a/tvix/Cargo.nix b/tvix/Cargo.nix
index 321ed98d4484..25a9a4e6b34e 100644
--- a/tvix/Cargo.nix
+++ b/tvix/Cargo.nix
@@ -1,4 +1,4 @@
-# This file was @generated by crate2nix 0.14.0 with the command:
+# This file was @generated by crate2nix 0.14.1 with the command:
 #   "generate" "--all-features"
 # See https://github.com/kolloch/crate2nix for more info.
 
@@ -13,6 +13,8 @@
 , rootFeatures ? [ "default" ]
   # If true, throw errors instead of issueing deprecation warnings.
 , strictDeprecation ? false
+  # Elements to add to the `-C target-feature=` argument passed to `rustc`
+  # (separated by `,`, prefixed with `+`).
   # Used for conditional compilation based on CPU feature detection.
 , targetFeatures ? [ ]
   # Whether to perform release builds: longer compile times, faster binaries.
@@ -2281,7 +2283,7 @@ rec {
           {
             name = "libc";
             packageId = "libc";
-            target = { target, features }: (pkgs.rust.lib.toRustTarget stdenv.hostPlatform == "aarch64-linux-android");
+            target = { target, features }: (stdenv.hostPlatform.rust.rustcTarget == "aarch64-linux-android");
           }
           {
             name = "libc";
@@ -6385,12 +6387,7 @@ rec {
             requiredFeatures = [ ];
           }
         ];
-        # We can't filter paths with references in Nix 2.4
-        # See https://github.com/NixOS/nix/issues/5410
-        src =
-          if ((lib.versionOlder builtins.nixVersion "2.4pre20211007") || (lib.versionOlder "2.5" builtins.nixVersion))
-          then lib.cleanSourceWith { filter = sourceFilter; src = ./nix-compat; }
-          else ./nix-compat;
+        src = lib.cleanSourceWith { filter = sourceFilter; src = ./nix-compat; };
         dependencies = [
           {
             name = "bitflags";
@@ -13284,12 +13281,7 @@ rec {
             requiredFeatures = [ ];
           }
         ];
-        # We can't filter paths with references in Nix 2.4
-        # See https://github.com/NixOS/nix/issues/5410
-        src =
-          if ((lib.versionOlder builtins.nixVersion "2.4pre20211007") || (lib.versionOlder "2.5" builtins.nixVersion))
-          then lib.cleanSourceWith { filter = sourceFilter; src = ./build; }
-          else ./build;
+        src = lib.cleanSourceWith { filter = sourceFilter; src = ./build; };
         dependencies = [
           {
             name = "bytes";
@@ -13373,12 +13365,7 @@ rec {
         crateName = "tvix-castore";
         version = "0.1.0";
         edition = "2021";
-        # We can't filter paths with references in Nix 2.4
-        # See https://github.com/NixOS/nix/issues/5410
-        src =
-          if ((lib.versionOlder builtins.nixVersion "2.4pre20211007") || (lib.versionOlder "2.5" builtins.nixVersion))
-          then lib.cleanSourceWith { filter = sourceFilter; src = ./castore; }
-          else ./castore;
+        src = lib.cleanSourceWith { filter = sourceFilter; src = ./castore; };
         dependencies = [
           {
             name = "async-compression";
@@ -13638,12 +13625,7 @@ rec {
             requiredFeatures = [ ];
           }
         ];
-        # We can't filter paths with references in Nix 2.4
-        # See https://github.com/NixOS/nix/issues/5410
-        src =
-          if ((lib.versionOlder builtins.nixVersion "2.4pre20211007") || (lib.versionOlder "2.5" builtins.nixVersion))
-          then lib.cleanSourceWith { filter = sourceFilter; src = ./cli; }
-          else ./cli;
+        src = lib.cleanSourceWith { filter = sourceFilter; src = ./cli; };
         dependencies = [
           {
             name = "bytes";
@@ -13730,12 +13712,7 @@ rec {
         crateName = "tvix-eval";
         version = "0.1.0";
         edition = "2021";
-        # We can't filter paths with references in Nix 2.4
-        # See https://github.com/NixOS/nix/issues/5410
-        src =
-          if ((lib.versionOlder builtins.nixVersion "2.4pre20211007") || (lib.versionOlder "2.5" builtins.nixVersion))
-          then lib.cleanSourceWith { filter = sourceFilter; src = ./eval; }
-          else ./eval;
+        src = lib.cleanSourceWith { filter = sourceFilter; src = ./eval; };
         libName = "tvix_eval";
         dependencies = [
           {
@@ -13897,12 +13874,7 @@ rec {
         crateName = "tvix-eval-builtin-macros";
         version = "0.0.1";
         edition = "2021";
-        # We can't filter paths with references in Nix 2.4
-        # See https://github.com/NixOS/nix/issues/5410
-        src =
-          if ((lib.versionOlder builtins.nixVersion "2.4pre20211007") || (lib.versionOlder "2.5" builtins.nixVersion))
-          then lib.cleanSourceWith { filter = sourceFilter; src = ./eval/builtin-macros; }
-          else ./eval/builtin-macros;
+        src = lib.cleanSourceWith { filter = sourceFilter; src = ./eval/builtin-macros; };
         procMacro = true;
         authors = [
           "Griffin Smith <root@gws.fyi>"
@@ -13934,12 +13906,7 @@ rec {
         crateName = "tvix-glue";
         version = "0.1.0";
         edition = "2021";
-        # We can't filter paths with references in Nix 2.4
-        # See https://github.com/NixOS/nix/issues/5410
-        src =
-          if ((lib.versionOlder builtins.nixVersion "2.4pre20211007") || (lib.versionOlder "2.5" builtins.nixVersion))
-          then lib.cleanSourceWith { filter = sourceFilter; src = ./glue; }
-          else ./glue;
+        src = lib.cleanSourceWith { filter = sourceFilter; src = ./glue; };
         dependencies = [
           {
             name = "async-compression";
@@ -14106,12 +14073,7 @@ rec {
         crateName = "tvix-serde";
         version = "0.1.0";
         edition = "2021";
-        # We can't filter paths with references in Nix 2.4
-        # See https://github.com/NixOS/nix/issues/5410
-        src =
-          if ((lib.versionOlder builtins.nixVersion "2.4pre20211007") || (lib.versionOlder "2.5" builtins.nixVersion))
-          then lib.cleanSourceWith { filter = sourceFilter; src = ./serde; }
-          else ./serde;
+        src = lib.cleanSourceWith { filter = sourceFilter; src = ./serde; };
         dependencies = [
           {
             name = "bstr";
@@ -14141,12 +14103,7 @@ rec {
             requiredFeatures = [ ];
           }
         ];
-        # We can't filter paths with references in Nix 2.4
-        # See https://github.com/NixOS/nix/issues/5410
-        src =
-          if ((lib.versionOlder builtins.nixVersion "2.4pre20211007") || (lib.versionOlder "2.5" builtins.nixVersion))
-          then lib.cleanSourceWith { filter = sourceFilter; src = ./store; }
-          else ./store;
+        src = lib.cleanSourceWith { filter = sourceFilter; src = ./store; };
         dependencies = [
           {
             name = "anyhow";
@@ -14368,12 +14325,7 @@ rec {
         crateName = "tvix-tracing";
         version = "0.1.0";
         edition = "2021";
-        # We can't filter paths with references in Nix 2.4
-        # See https://github.com/NixOS/nix/issues/5410
-        src =
-          if ((lib.versionOlder builtins.nixVersion "2.4pre20211007") || (lib.versionOlder "2.5" builtins.nixVersion))
-          then lib.cleanSourceWith { filter = sourceFilter; src = ./tracing; }
-          else ./tracing;
+        src = lib.cleanSourceWith { filter = sourceFilter; src = ./tracing; };
         dependencies = [
           {
             name = "http";
@@ -15940,12 +15892,12 @@ rec {
           {
             name = "winapi-i686-pc-windows-gnu";
             packageId = "winapi-i686-pc-windows-gnu";
-            target = { target, features }: (pkgs.rust.lib.toRustTarget stdenv.hostPlatform == "i686-pc-windows-gnu");
+            target = { target, features }: (stdenv.hostPlatform.rust.rustcTarget == "i686-pc-windows-gnu");
           }
           {
             name = "winapi-x86_64-pc-windows-gnu";
             packageId = "winapi-x86_64-pc-windows-gnu";
-            target = { target, features }: (pkgs.rust.lib.toRustTarget stdenv.hostPlatform == "x86_64-pc-windows-gnu");
+            target = { target, features }: (stdenv.hostPlatform.rust.rustcTarget == "x86_64-pc-windows-gnu");
           }
         ];
         features = {
@@ -17311,7 +17263,7 @@ rec {
           {
             name = "windows_aarch64_gnullvm";
             packageId = "windows_aarch64_gnullvm 0.48.5";
-            target = { target, features }: (pkgs.rust.lib.toRustTarget stdenv.hostPlatform == "aarch64-pc-windows-gnullvm");
+            target = { target, features }: (stdenv.hostPlatform.rust.rustcTarget == "aarch64-pc-windows-gnullvm");
           }
           {
             name = "windows_aarch64_msvc";
@@ -17336,7 +17288,7 @@ rec {
           {
             name = "windows_x86_64_gnullvm";
             packageId = "windows_x86_64_gnullvm 0.48.5";
-            target = { target, features }: (pkgs.rust.lib.toRustTarget stdenv.hostPlatform == "x86_64-pc-windows-gnullvm");
+            target = { target, features }: (stdenv.hostPlatform.rust.rustcTarget == "x86_64-pc-windows-gnullvm");
           }
           {
             name = "windows_x86_64_msvc";
@@ -17358,7 +17310,7 @@ rec {
           {
             name = "windows_aarch64_gnullvm";
             packageId = "windows_aarch64_gnullvm 0.52.5";
-            target = { target, features }: (pkgs.rust.lib.toRustTarget stdenv.hostPlatform == "aarch64-pc-windows-gnullvm");
+            target = { target, features }: (stdenv.hostPlatform.rust.rustcTarget == "aarch64-pc-windows-gnullvm");
           }
           {
             name = "windows_aarch64_msvc";
@@ -17373,7 +17325,7 @@ rec {
           {
             name = "windows_i686_gnullvm";
             packageId = "windows_i686_gnullvm";
-            target = { target, features }: (pkgs.rust.lib.toRustTarget stdenv.hostPlatform == "i686-pc-windows-gnullvm");
+            target = { target, features }: (stdenv.hostPlatform.rust.rustcTarget == "i686-pc-windows-gnullvm");
           }
           {
             name = "windows_i686_msvc";
@@ -17388,7 +17340,7 @@ rec {
           {
             name = "windows_x86_64_gnullvm";
             packageId = "windows_x86_64_gnullvm 0.52.5";
-            target = { target, features }: (pkgs.rust.lib.toRustTarget stdenv.hostPlatform == "x86_64-pc-windows-gnullvm");
+            target = { target, features }: (stdenv.hostPlatform.rust.rustcTarget == "x86_64-pc-windows-gnullvm");
           }
           {
             name = "windows_x86_64_msvc";
@@ -17844,14 +17796,11 @@ rec {
       fuchsia = true;
       test = false;
 
-      /* We are choosing an arbitrary rust version to grab `lib` from,
-      which is unfortunate, but `lib` has been version-agnostic the
-      whole time so this is good enough for now.
-      */
-      os = pkgs.rust.lib.toTargetOs platform;
-      arch = pkgs.rust.lib.toTargetArch platform;
-      family = pkgs.rust.lib.toTargetFamily platform;
-      vendor = pkgs.rust.lib.toTargetVendor platform;
+      inherit (platform.rust.platform)
+        arch
+        os
+        vendor;
+      family = platform.rust.platform.target-family;
       env = "gnu";
       endian =
         if platform.parsed.cpu.significantByte.name == "littleEndian"
@@ -18095,7 +18044,7 @@ rec {
             let
               self = {
                 crates = lib.mapAttrs (packageId: value: buildByPackageIdForPkgsImpl self pkgs packageId) crateConfigs;
-                target = makeTarget pkgs.stdenv.hostPlatform;
+                target = makeTarget stdenv.hostPlatform;
                 build = mkBuiltByPackageIdByPkgs pkgs.buildPackages;
               };
             in
diff --git a/tvix/default.nix b/tvix/default.nix
index a181484286e9..bfa02e72d216 100644
--- a/tvix/default.nix
+++ b/tvix/default.nix
@@ -14,22 +14,12 @@ let
   # Load the crate2nix crate tree.
   crates = pkgs.callPackage ./Cargo.nix {
     defaultCrateOverrides = pkgs.defaultCrateOverrides // {
-      opentelemetry-proto = prev: {
-        nativeBuildInputs = protobufDep prev;
-      };
-
-      prost-build = prev: {
-        nativeBuildInputs = protobufDep prev;
-      };
-
-      prost-wkt-types = prev: {
-        nativeBuildInputs = protobufDep prev;
-      };
-
-      tonic-reflection = prev: {
-        nativeBuildInputs = protobufDep prev;
+      nix-compat = prev: {
+        src = depot.tvix.utils.filterRustCrateSrc rec {
+          root = prev.src.origSrc;
+          extraFileset = (root + "/testdata");
+        };
       };
-
       tvix-build = prev: {
         src = depot.tvix.utils.filterRustCrateSrc rec {
           root = prev.src.origSrc;
@@ -91,13 +81,6 @@ let
       tvix-tracing = prev: {
         src = depot.tvix.utils.filterRustCrateSrc { root = prev.src.origSrc; };
       };
-
-      nix-compat = prev: {
-        src = depot.tvix.utils.filterRustCrateSrc rec {
-          root = prev.src.origSrc;
-          extraFileset = (root + "/testdata");
-        };
-      };
     };
   };
 
@@ -166,10 +149,12 @@ in
         # minute or two.
         cargo metadata > /dev/null
 
-        # running this command counteracts depotfmt brokenness
-        git init
-
-        ${depot.tools.crate2nix-generate}/bin/crate2nix-generate
+        ${pkgs.crate2nix}/bin/crate2nix generate --all-features
+        ${pkgs.treefmt}/bin/treefmt Cargo.nix \
+          --no-cache \
+          --on-unmatched=debug \
+          --config-file=${depot.tools.depotfmt.config} \
+          --tree-root=.
 
         # technically unnecessary, but provides more-helpful output in case of error
         diff -ur Cargo.nix ${src}/Cargo.nix
diff --git a/tvix/glue/src/builtins/derivation.rs b/tvix/glue/src/builtins/derivation.rs
index 473aa9d5e315..b17b90466965 100644
--- a/tvix/glue/src/builtins/derivation.rs
+++ b/tvix/glue/src/builtins/derivation.rs
@@ -347,9 +347,9 @@ pub(crate) mod derivation_builtins {
                             input_context.mimic(&val_str);
 
                             if arg_name == "builder" {
-                                drv.builder = val_str.to_str()?.to_owned();
+                                val_str.to_str()?.clone_into(&mut drv.builder);
                             } else {
-                                drv.system = val_str.to_str()?.to_owned();
+                                val_str.to_str()?.clone_into(&mut drv.system);
                             }
 
                             // Either populate drv.environment or structured_attrs.
diff --git a/tvix/nix-compat/src/derivation/write.rs b/tvix/nix-compat/src/derivation/write.rs
index 735b781574e1..2ff68b6edba8 100644
--- a/tvix/nix-compat/src/derivation/write.rs
+++ b/tvix/nix-compat/src/derivation/write.rs
@@ -32,13 +32,6 @@ pub const QUOTE: char = '"';
 /// the context a lot.
 pub(crate) trait AtermWriteable {
     fn aterm_write(&self, writer: &mut impl Write) -> std::io::Result<()>;
-
-    fn aterm_bytes(&self) -> Vec<u8> {
-        let mut bytes = Vec::new();
-        self.aterm_write(&mut bytes)
-            .expect("unexpected write errors to Vec");
-        bytes
-    }
 }
 
 impl AtermWriteable for StorePathRef<'_> {
diff --git a/tvix/nix-compat/src/wire/bytes/mod.rs b/tvix/nix-compat/src/wire/bytes/mod.rs
index 2ed071e37985..47bfb5eabacf 100644
--- a/tvix/nix-compat/src/wire/bytes/mod.rs
+++ b/tvix/nix-compat/src/wire/bytes/mod.rs
@@ -33,12 +33,9 @@ const LEN_SIZE: usize = 8;
 ///
 /// This buffers the entire payload into memory,
 /// a streaming version is available at [crate::wire::bytes::BytesReader].
-pub async fn read_bytes<R: ?Sized>(
-    r: &mut R,
-    allowed_size: RangeInclusive<usize>,
-) -> io::Result<Vec<u8>>
+pub async fn read_bytes<R>(r: &mut R, allowed_size: RangeInclusive<usize>) -> io::Result<Vec<u8>>
 where
-    R: AsyncReadExt + Unpin,
+    R: AsyncReadExt + Unpin + ?Sized,
 {
     // read the length field
     let len = r.read_u64_le().await?;
@@ -82,13 +79,13 @@ where
     Ok(buf)
 }
 
-pub(crate) async fn read_bytes_buf<'a, const N: usize, R: ?Sized>(
+pub(crate) async fn read_bytes_buf<'a, const N: usize, R>(
     reader: &mut R,
     buf: &'a mut [MaybeUninit<u8>; N],
     allowed_size: RangeInclusive<usize>,
 ) -> io::Result<&'a [u8]>
 where
-    R: AsyncReadExt + Unpin,
+    R: AsyncReadExt + Unpin + ?Sized,
 {
     assert_eq!(N % 8, 0);
     assert!(*allowed_size.end() <= N);
diff --git a/users/tazjin/nixos/frog/default.nix b/users/tazjin/nixos/frog/default.nix
index dfb6b46d5aa1..349c5eb6d81a 100644
--- a/users/tazjin/nixos/frog/default.nix
+++ b/users/tazjin/nixos/frog/default.nix
@@ -43,7 +43,6 @@ lib.fix (self: {
     enableRedistributableFirmware = true;
     opengl = {
       enable = true;
-      driSupport = true;
       driSupport32Bit = true;
     };