ci: fix nix build (bech32 vendoring failure)

[sethforprivacy]

Root cause

Cargo.lock is internally inconsistent — it is missing the [[package]] stanzas for the crates that only silentpayments depends on.

The silentpayments entry declares:

[[package]]
name = "silentpayments"
version = "0.3.0"
source = "git+https://github.com/cygnet3/rust-silentpayments?branch=master#48e2730d..."
dependencies = [
 "bech32 0.9.1",          # <- no [[package]] stanza existed
 "bitcoin_hashes 0.13.0", # <- no [[package]] stanza existed
 "secp256k1 0.28.2",      # <- no [[package]] stanza existed
 ...
]

but the lock only contained bech32 0.8.1 and 0.11.0, and had no bitcoin_hashes 0.13.x or secp256k1 0.28.x at all. The electrs package entry had also lost its own hex dependency (declared as hex = "0.4" in Cargo.toml).

This was introduced by commit 9dffb84 "Merge new-index branch into cake-update-v1" (2026-02-13). The Cargo.lock conflict was resolved by taking the upstream (new-index) side for the crate stanzas, while keeping the silentpayments package entry from the cake side:

commit	bech32 stanzas	has silentpayments
cf9e03b (cake parent)	3 (incl. 0.9.1)	yes
477c1a3 (new-index parent)	2	no
9dffb84 (merge result)	2	yes ← inconsistent

Why only the nix job fails

The check / test / test-liquid jobs run plain cargo, which does not pass --locked. Cargo silently repairs the incomplete lock over the network and carries on, so those jobs stay green and the corruption goes unnoticed.

The nix job builds with crane, which vendors dependencies strictly from the committed Cargo.lock into a directory source that replaces the crates-io registry, then builds offline. A stanza that isn't in the lock simply doesn't get vendored and cannot be recovered:

+++ command cargo check --release --all-features --all-targets
error: failed to select a version for the requirement `bech32 = "^0.9"`
candidate versions found which didn't match: 0.11.0, 0.8.1
location searched: directory source `/nix/store/...-vendor-cargo-deps/...` (which is replacing registry `crates-io`)
required by package `silentpayments v0.3.0 (https://github.com/cygnet3/rust-silentpayments?branch=master#48e2730d)`
    ... which satisfies git dependency `silentpayments` (locked to 0.3.0) of package `electrs v0.4.1 (/build/source)`
perhaps a crate was updated and forgotten to be re-vendored?

The --all-features in flake.nix (added in c7d0da2 as an earlier attempt at this bug) is what pulls the silent-payments feature — and therefore silentpayments — into the deps derivation. It is correct and is left as-is; the lock was the actual problem.

The fix

Regenerated Cargo.lock with the pinned toolchain (cargo 1.75.0, matching rust-toolchain.toml and the CI jobs). The change is purely additive:

Added (5): bech32 0.9.1, bitcoin_hashes 0.13.1, hex-conservative 0.1.2, secp256k1 0.28.2, secp256k1-sys 0.9.2
Removed (0). No existing package version changed. Lock format stays version = 3. The silentpayments git rev is unchanged (48e2730d).

Also incidental and required: silentpayments' dangling bitcoin_hashes 0.13.0 reference now resolves to the real 0.13.1; electrs regains its declared hex dependency; and existing bare hex-conservative references are version-disambiguated now that two versions coexist.

Evidence

--locked is a faithful proxy for crane's offline vendored build — it forbids exactly the network lock-repair that masks this bug:

# before (committed lock at aae16bf)
$ cargo metadata --locked
error: the lock file .../Cargo.lock needs to be updated but --locked was passed to prevent this
exit=101

# after
$ cargo check --locked --release --all-features
    Checking bitcoin_hashes v0.13.1
    Checking secp256k1 v0.28.2
    Checking bech32 v0.9.1
    Checking silentpayments v0.3.0 (https://github.com/cygnet3/rust-silentpayments?branch=master#48e2730d)
    Finished release [optimized] target(s)
exit=0

Historical failures

The nix job has failed on every run of cake-update-v2 since the branch's first CI run on 2026-02-24, and identically on the unrelated PR #3:

• #2 cake-update-v2 run 22369719686 (2026-02-24, first run on the branch) — through run 22379579959 (2026-02-25); 11 runs, all failing
• #3 run 31881814177 (2026-08-15) — same bech32 = ^0.9 signature, confirming it is a base-branch defect and not PR perf(sp): eliminate per-tx DB iterator reads in tweaks.subscribe #3's work

The last green CI run was 21997190123 on new-index (2026-02-13), which predates silentpayments on that branch entirely.

Caveat

cargo check --all-features --all-targets (crane's exact command, including dev-dependencies) cannot be reproduced on macOS: the electrumd dev-dependency's build.rs defines download_filename() only under cfg(all(target_os = "linux", target_arch = "x86_64")) and calls it unconditionally, so it fails to compile on any other platform regardless of ELECTRUMD_SKIP_DOWNLOAD. That is pre-existing and unrelated to this change; CI runs linux-x86_64, where it compiles. The all-features check above was run without --all-targets for this reason, and the nix check on this PR is the authoritative verification.

🤖 Generated with Claude Code