Build failure: tinycc, cdimgtools, docutils and other packages using fetchFromRepoOrCz cannot download sources from the UK

[stefano-m]

Nixpkgs version

• Stable (25.05)

Steps to reproduce

The fetchFromRepoOrCz function in pkgs/build-support/fetchrepoorcz/default.nix downloads sources from https://repo.or.cz/

Unfortunately, the site blocks connections from the UK due to the Online Safety act and redirects all requests to https://repo.or.cz/uk-blocked.html

I noticed this while trying to build docutils from a UK-based build machine. The build error is

nix log /nix/store/q9q3xki1m7miwk8p9dqb6wjlq8mg0m11-source.drv

trying https://repo.or.cz/docutils.git/snapshot/docutils-0.21.2.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   242  100   242    0     0    331      0 --:--:-- --:--:-- --:--:--   331
100  2517  100  2517    0     0   3275      0 --:--:-- --:--:-- --:--:--     0
unpacking source archive /build/docutils-0.21.2.tar.gz

gzip: stdin: not in gzip format
tar: Child returned status 1
tar: Error is not recoverable: exiting now
do not know how to unpack source archive /build/docutils-0.21.2.tar.gz

In fact, if one runs curl -LO https://repo.or.cz/docutils.git/snapshot/docutils-0.21.2.tar.gz the resulting file will contain the data from https://repo.or.cz/uk-blocked.html which is not a valid gzip archive.

I searched for issues mentioning fetchFromRepoOrCz but found none.

A quick search with rg in the repository returns only 7 packages using the function:

• pkgs/by-name/wi/windowmaker/package.nix (declared but not used)
• pkgs/by-name/ti/tinycc/package.nix
• pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix (declared but not used)
• pkgs/by-name/cd/cdimgtools/package.nix
• pkgs/by-name/sy/syslinux/package.nix
• pkgs/by-name/gl/glpng/package.nix
• pkgs/development/python-modules/docutils/default.nix

Can Hydra reproduce this build failure?

No, Hydra cannot reproduce this build failure.

Link to Hydra build job

No response

Relevant log output

docutils on an i686

nix log /nix/store/q9q3xki1m7miwk8p9dqb6wjlq8mg0m11-source.drv

trying https://repo.or.cz/docutils.git/snapshot/docutils-0.21.2.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   242  100   242    0     0    331      0 --:--:-- --:--:-- --:--:--   331
100  2517  100  2517    0     0   3275      0 --:--:-- --:--:-- --:--:--     0
unpacking source archive /build/docutils-0.21.2.tar.gz

gzip: stdin: not in gzip format
tar: Child returned status 1
tar: Error is not recoverable: exiting now
do not know how to unpack source archive /build/docutils-0.21.2.tar.gz

tinycc on an i686

nix-build -I nixpkgs=/etc/nixpkgs '<nixpkgs>' --attr tinycc
these 3 derivations will be built:
  /nix/store/gbzvgibfic9nm3d3ssvvqf00f6n9pryx-source.drv
  /nix/store/hlp8s9r43dbrzdw3xrqg19hl8fbn7x0b-libtcc.pc.drv
  /nix/store/2kf9hm960vfzjwnrdiq2z5pqfa4g680j-tcc-0.9.27-unstable-2025-01-06.drv
building '/nix/store/hlp8s9r43dbrzdw3xrqg19hl8fbn7x0b-libtcc.pc.drv'...
building '/nix/store/gbzvgibfic9nm3d3ssvvqf00f6n9pryx-source.drv'...

trying https://repo.or.cz/tinycc.git/snapshot/f6385c05308f715bdd2c06336801193a21d69b50.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   242  100   242    0     0    787      0 --:--:-- --:--:-- --:--:--   788
100  2517  100  2517    0     0   7423      0 --:--:-- --:--:-- --:--:--  7423
unpacking source archive /build/f6385c05308f715bdd2c06336801193a21d69b50.tar.gz

gzip: stdin: not in gzip format
tar: Child returned status 1
tar: Error is not recoverable: exiting now
do not know how to unpack source archive /build/f6385c05308f715bdd2c06336801193a21d69b50.tar.gz
error: builder for '/nix/store/gbzvgibfic9nm3d3ssvvqf00f6n9pryx-source.drv' failed with exit code 1
error: 1 dependencies of derivation '/nix/store/2kf9hm960vfzjwnrdiq2z5pqfa4g680j-tcc-0.9.27-unstable-2025-01-06.drv' failed to build

cdimgtools on an x86_64

nix build --offline 'nixpkgs#cdimgtools'
error: builder for '/nix/store/4lr0c2yqa9l3a4fka97fncvhkvh14sc2-source.drv' failed with exit code 1;
       last 12 log lines:
       >
       > trying https://repo.or.cz/cdimgtools.git/snapshot/version/0.3.tar.gz
       >   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
       >                                  Dload  Upload   Total   Spent    Left  Speed
       > 100   242  100   242    0     0    623      0 --:--:-- --:--:-- --:--:--   623
       > 100  2517  100  2517    0     0   5007      0 --:--:-- --:--:-- --:--:--  5007
       > unpacking source archive /build/0.3.tar.gz
       >
       > gzip: stdin: not in gzip format
       > tar: Child returned status 1
       > tar: Error is not recoverable: exiting now
       > do not know how to unpack source archive /build/0.3.tar.gz

Additional context

No response

System metadata

• system: "i686-linux"
• host os: Linux 6.12.42, NixOS, 25.05 (Warbler), 25.05.20250819.a58390a
• multi-user?: no
• sandbox: yes
• version: nix-env (Nix) 2.28.4
• nixpkgs: /nix/store/lgzfgc1acidk895knamw9kywlhmdwv9h-source

Notify maintainers

• docutils: no maintainer
• tinycc: @joachifm
• syslinux: no maintainer
• cdimgtools: @hhm0
• glpng: no maintainer

---

Note for maintainers: Please tag this issue in your pull request description. (i.e. Resolves #ISSUE.)

I assert that this issue is relevant for Nixpkgs

• I assert that this is a bug and not a support request.
• I assert that this is not a duplicate of an existing issue.
• I assert that I have read the NixOS Code of Conduct and agree to abide by it.

Is this issue important to you?

Add a 👍 reaction to issues you find important.

[fmbearmf]

are there reliable mirrors of repo.or.cz that don't have that issue?

if not, i don't think this is an issue we can really address. they're deliberately not serving to UK IPs to avoid being fined.
for now just use a proxy/VPN i guess.

[pyrox0]

are there reliable mirrors of repo.or.cz that don't have that issue?

if not, i don't think this is an issue we can really address. they're deliberately not serving to UK IPs to avoid being fined. for now just use a proxy/VPN i guess.

The best option may be using fetchurl with an archive.org url, but not sure how good of an idea it is. It's the best one I've got, though.

[magicquark]

As docutils is a Python package, its source is available on PyPI (https://pypi.org/project/docutils/0.21.2/#files). The official website for docutils uses svn and only lists repo.or.cz as a mirror for git access (https://docutils.sourceforge.io/docs/dev/repository.html).

Sourceforge also has the code (https://sourceforge.net/projects/docutils/files/docutils/).

The derivation for docutils in nixpkgs (https://github.com/NixOS/nixpkgs/blob/nixos-25.05/pkgs/development/python-modules/docutils/default.nix#L11) has some comments about not being able to use fetchgit.

Note: this package is used to build LLVM’s documentation, which is part of the Darwin stdenv. It cannot use fetchgit because that would pull curl into the bootstrap, which is disallowed.

Maybe another source could be used, maybe not; it all depends on if the source fetcher affects the comment above.

[stefano-m]

I was able to build docutils using fetchPypi and will do my best to submit a PR.

[stefano-m]

PR for docutils: #446852 (invalid as it's against the main branch)

This is the correct PR: #448906

[stefano-m]

Apparently docutils has already been fixed by de056b7 so my PR is actually not useful any more.

[reckenrode]

FWIW, the LLVM documentation is no longer built during the Darwin stdenv bootstrap. It may be possible to use fetchgit in the future.

[SomeoneSerge]

"Contact your MP", I guess?

[SomeoneSerge]

The derivation for docutils in nixpkgs [...] has some comments about not being able to use fetchgit.

Note: this package is used to build LLVM’s documentation, which is part of the Darwin stdenv. It cannot use fetchgit because that would pull curl into the bootstrap, which is disallowed.

Do we get different hashes/how hard would it be to maintain postPatches to ensure that fetchFromRepoOrCz hash matches fetchsvn/fetchurl? I'm not aware of any good infra for these situations, but if the hashes match, we could at least expose those additional variants of the FOD somewhere reachable via recurseIntoAttrs, and notify the user about the attribute names in a failureHook... these variants would not have had to care about bootstrap

[timka]

The best option may be using fetchurl with an archive.org url, but not sure how good of an idea it is. It's the best one I've got, though.

As of my experience, web.archive.org may reply something like 'unavailable in your region' for some particular URLs. But If you go through VPN/proxy it works. That is, they sort of handle takedown requests.