Unable to nixos-rebuild switch on 21.11; HTTP 403 downloading a blob from Intel

[cmars]

Issue description

Unable to nixos-rebuild switch on my 21.11 machine. I've been running NixOS for quite a while now with no issues up until now.

Pastes slightly redacted (host and user) below.

Steps to reproduce

Build consistently failing for the past couple days, failing to download a blob from Intel:

# nixos-rebuild switch
building Nix...
building the system configuration...
these derivations will be built:
  /nix/store/n06dlhb67dc70vk9jzmklrk6gjy0fj6d-source.drv
  /nix/store/j8p1qrnhh252874v4cjncms5hcink02c-intel-ocl-5.0-63503.drv
  /nix/store/yigx1qwmdlfdsawz67mamd1hldgn2vvn-opengl-drivers.drv
  /nix/store/72bv9d0whxsfkjyhp1h4k87p65xahdlf-nixos-tmpfiles.d.drv
  /nix/store/y3qhcc1j13k4xxv0ahzhkcxff1g7qbwv-tmpfiles.d.drv
  /nix/store/52i5kfvajxd07yr56gi6dmbdbvhlhz6q-etc.drv
  /nix/store/g8bfwmwrg166zzybypwi2d9rh4f9h4as-nixos-system-nix-HOST-21.11.336755.efea022d6fe.drv
building '/nix/store/n06dlhb67dc70vk9jzmklrk6gjy0fj6d-source.drv'...

trying https://registrationcenter-download.intel.com/akdlm/irc_nas/11396/SRB5.0_linux64.zip
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:--  0:00:03 --:--:--     0
curl: (22) The requested URL returned error: 403
error: cannot download source from any mirror
builder for '/nix/store/n06dlhb67dc70vk9jzmklrk6gjy0fj6d-source.drv' failed with exit code 1
cannot build derivation '/nix/store/j8p1qrnhh252874v4cjncms5hcink02c-intel-ocl-5.0-63503.drv': 1 dependencies couldn't be built
cannot build derivation '/nix/store/yigx1qwmdlfdsawz67mamd1hldgn2vvn-opengl-drivers.drv': 1 dependencies couldn't be built
cannot build derivation '/nix/store/72bv9d0whxsfkjyhp1h4k87p65xahdlf-nixos-tmpfiles.d.drv': 1 dependencies couldn't be built
cannot build derivation '/nix/store/y3qhcc1j13k4xxv0ahzhkcxff1g7qbwv-tmpfiles.d.drv': 1 dependencies couldn't be built
cannot build derivation '/nix/store/52i5kfvajxd07yr56gi6dmbdbvhlhz6q-etc.drv': 1 dependencies couldn't be built
cannot build derivation '/nix/store/g8bfwmwrg166zzybypwi2d9rh4f9h4as-nixos-system-nix-HOST-21.11.336755.efea022d6fe.drv': 1 dependencies couldn't be built
error: build of '/nix/store/g8bfwmwrg166zzybypwi2d9rh4f9h4as-nixos-system-nix-HOST-21.11.336755.efea022d6fe.drv' failed

Is there a hardware configuration change I can make to avoid this particular blob?

Technical details

Please run nix-shell -p nix-info --run "nix-info -m" and paste the result:

# nix-shell -p nix-info --run "nix-info -m"
these paths will be fetched (0.06 MiB download, 0.30 MiB unpacked):
  /nix/store/n32py8bgkgi73llcc57kffrnwnaf0vm4-bash-interactive-5.1-p8-dev
copying path '/nix/store/n32py8bgkgi73llcc57kffrnwnaf0vm4-bash-interactive-5.1-p8-dev' from 'https://cache.nixos.org'...
 - system: `"x86_64-linux"`
 - host os: `Linux 5.10.103, NixOS, 21.11 (Porcupine)`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.3.16`
 - channels(root): `"nixos-21.11.336755.efea022d6fe, nixpkgs-unstable-22.05pre363562.30d3d79b7d3, nixos-unstable-22.05pre365028.710fed5a248"`
 - channels(USER): `"home-manager-21.11"`
 - nixpkgs: `/nix/var/nix/profiles/per-user/root/channels/nixos`

[cmars]

Ok, figured out how to get past this by removing intel-ocl. Commenting it out for example fixes it:

  hardware.opengl = {
    enable = true;
    driSupport = true;
    extraPackages = with pkgs; [ vaapiIntel libvdpau-va-gl vaapiVdpau ]; # intel-ocl ];
  };

So this is perhaps a problem with the link in that particular package?

[Artturin]

weird, it looks like its now available via http only but in 2019 it was changed to download via https because http didn't work #62097

[cmars]

I don't want a binary blob downloaded insecurely, in any package...

[Artturin]

the sha256 is still checked

[tpwrules]

I wonder if this needs an alternate source. Both URLs 403 for me with wget, and both 404 for me with Firefox.

[Artturin]

a webarchive url could be added

[sumnerevans]

I'm going to re-open this because the URLs still are broken.

[Artturin]

Please create a pr