fetchGit: add binary substitution support

[sheldonneuberger-sc]

Motivation

The fetchGit builtin should try to substitute before falling back to git clone. This is useful in a couple of situations:

• You have users that won't have authorization to clone from the git repo, but that will have have auth to a binary substituter.
• Your binary substituter has better speed/reliability than your git server.

Related issues:

• Substitute builtin url fetchers #4313 (comment)
• [question] fetchGit workflow with private repositories #5407

Context

Tasks:

• Tested cache hit by observing log output of copying path '/nix/store/3d5nn0bw1ja7wad3pir3a8wp2xp49zsx-source' from 'https://my-nix-cache.internal.com'..., and observing that the git clone log output is no longer occurring.
• Tested cache miss by observing git clone log output.

Checklist for maintainers

Maintainers: tick if completed or explain if not relevant

• agreed on idea
• agreed on implementation strategy
• tests, as appropriate
  • functional tests - tests/**.sh
  • unit tests - src/*/tests
  • integration tests - tests/nixos/*
• documentation in the manual
• documentation in the internal API docs
• code and comments are self-explanatory
• commit message explains why the change was made
• new feature or incompatible change: updated release notes

Priorities

Add 👍 to pull requests you find important.

[edolstra]

We definitely cannot provide fake values depending on whether the path was substituted. That would make evaluation non-deterministic.

[sheldonneuberger-sc]

lastModified and revCount are both calculated from the git repo, which we don't have access to in the case of substitution (just the tree checkout, not the .git dir). Are those values written into a .drv file in the binary cache (I'm new to nix)?

If not, then I think we could require that the user specify narHash+lastModified+revCount if they want substitution to work.

[roberth]

You could make these values lazy, and retrieve them as usual, but only when needed. Though laziness isn't supported by libfetchers yet(?). nix::fetchers::Attrs currently only allows data; no callbacks.