build-support/rust: support multiple git dependencies with the same version

[andresilva]

Add the SHA hash to vendored git dependencies to make sure there are no clashes, since the dependencies might have the same version but point to different git commits.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• Nixpkgs 25.11 Release Notes (or backporting 24.11 and 25.05 Nixpkgs Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
• NixOS 25.11 Release Notes (or backporting 24.11 and 25.05 NixOS Release notes)
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other contributing documentation in corresponding paths.

---

Add a 👍 reaction to pull requests you find important.

[andresilva]

Here's an example of something that's fixed by this PR: https://github.com/paritytech/try-runtime-cli/blob/main/Cargo.lock#L15233-L15271

[TomaSajt]

There have been several fix PRs for this.
Here's mine: #387337

BTW, have you tested that this works correctly?
By this I mean that the package resolution actually uses both directories, instead of just one of the two.

[andresilva]

By this I mean that the package resolution actually uses both directories, instead of just one of the two.

No, I did not test this. It did fix the build of the package I was trying, but it probably would work anyway whatever directory it picked, so maybe that's a false positive. Your fix seems much more extensive, so maybe it's best to just close this PR.

[andresilva]

Closing because I'm not sure whether this is correct (I didn't really test whether the correct dependency is being used), and there have been multiple attempts at this problem.