fix(nix): pin cargoLock outputHashes for git deps, resync bun.lock

[andreszb]

Problem

nix build github:nab138/iloader fails at current main (8547013). Two independent bugs stack — fixing the first uncovers the second.

1. Missing vendor hashes for the two git-sourced crates

src-tauri/Cargo.lock has two git+ dependencies rather than crates.io releases:

• apple-codesign 0.1.0 — git+https://github.com/Dadoum/apple-crates#a505b2a
• isideload 0.3.17 — git+https://github.com/nab138/isideload?branch=apple-codesign-quick#3d42025

importCargoLock can't derive a fixed-output hash for a git dependency, so it has to be given one explicitly via cargoLock.outputHashes. Without that, evaluation fails immediately:

error: No hash was found while vendoring the git dependency apple-codesign-0.1.0.

Fixes #602. Fixes #594 — though note #594's secondary remark about the reported version string is a separate matter and isn't addressed here.

2. bun.lock's workspace ranges had drifted from package.json

With bug 1 fixed, the Rust side compiles and the frontend fails instead:

error: ConnectionRefused downloading package manifest react
error: ConnectionRefused downloading package manifest vite
... (14 total, one per direct/dev dependency)

package.json was bumped for 14 packages (react → ^19.2.8, vite → ^8.2.0, typescript → ~6.0.3, …) without bun.lock's workspace front-matter being refreshed — it still recorded ^19.2.4 / ^8.0.7 / ~6.0.2. bun i --frozen-lockfile responds to that drift by re-resolving every direct dependency against the npm registry.

This is invisible in CI: build.yml has network access, so the re-resolve just succeeds — it passed on 8547013. A Nix build has no network in the sandbox, so it fails there instead.

The packages section of bun.lock was already correct: it resolved react@19.2.8, vite@8.2.0, typescript@6.0.3 etc., all satisfying the newer ranges. Only the front-matter was stale.

Fix

• flake.nix — add cargoLock.outputHashes for the two git crates.
• bun.lock — regenerated with bun install against an unmodified package.json.

Verification

Hashes independently reproduced with nix-prefetch-git --fetch-submodules (matching fetchgit's defaults, which is what importCargoLock calls):

crate	rev	hash	provenance
apple-codesign 0.1.0	a505b2a	sha256-1ajD3aHa6mUuMYVH8jluIh49J0vKTp4vrfX4T2i3oTg=	current main tip of Dadoum/apple-crates
isideload 0.3.17	3d42025	sha256-oGE+dY68Gv1rmTSHCycakkSCMvUN9YjZHB1gJSikuho=	ancestor of apple-codesign-quick

bun.lock change is inert for everyone except Nix. The diff is 16 insertions / 16 deletions, entirely inside the workspace dependencies/devDependencies front-matter — no packages entry, no integrity hash, and no lockfileVersion changed. The vendored dependency set is provably unaffected: bun2nix's bunDeps derivation is byte-identical before and after the change (same …-bun-cache.drv). Nothing about what CI or contributors install changes.

Builds: nix build .#default succeeds, and the flake also builds consumed as an input in a NixOS system closure. default.nix / shell.nix are flake-compat wrappers, so they pick this up automatically.

Maintenance note

outputHashes keys are name+version and importCargoLock forces them, so bumping either crate in Cargo.lock will now hard-error until flake.nix is updated too:

error: A hash was specified for isideload-0.3.17, but there is no corresponding git dependency.

That's a loud failure rather than a silent one, but worth knowing about. To refresh: set the value to lib.fakeHash, run nix build, and read the expected hash back out of the mismatch error.