mirror-nixos-branch: add header for "Lockable HTTP Tarball Protocol" (Flakes)

This is part of another PR over in NixOS/infra that implements the
configuration change needed for Fastly and allows one to use

~~~nix
{
  inputs = {
    nixpkgs.url = "https://channels.nixos.org/nixos-unstable-small/nixexprs.tar.xz";
  };
}
~~~

and have it locked in flake.lock accordingly.

This has multiple advantages over using something like
github:NixOS/nixpkgs/nixos-unstable-small.

For example, channels.nixos.org and releases.nixos.org are accessible on
not just IPv4 but also IPv6, unlike GitHub.

Furthermore, the tarballs have a higher compression-ratio than those
served by GitHub and thus require less bandwidth to download.

Additionally, nixexprs.tar.xz contains the precomputed programs.sqlite
which enables the use of the very lightweight programs.command-not-found
with Flakes.

Ref: https://github.com/NixOS/nix/blob/61f49de7ae0b3899abdcc102832523153dd40d35/doc/manual/source/protocols/tarball-fetcher.md

Author: emilylange

mirror-nixos-branch.pl

@@ -342,16 +342,25 @@ sub fetch {
 my $cache_control = "maxage=600,stale-while-revalidate=1800,public";
 
 sub redirect {
-    my ($from, $to) = @_;
+    my ($from, $to, $immutable_flake_tarball) = @_;
     $to = "https://releases.nixos.org/" . $to;
     print STDERR "redirect $from -> $to\n";
-    $bucketChannels->add_key($from, "", { "x-amz-website-redirect-location" => $to, "cache-control" => $cache_control })
+    my $object_metadata = { "x-amz-website-redirect-location" => $to, "cache-control" => $cache_control };
+    if ($immutable_flake_tarball // 0) {
+        # Optionally sets a header for the "Lockable HTTP Tarball Protocol".
+        # See <https://github.com/NixOS/nix/blob/61f49de7ae0b3899abdcc102832523153dd40d35/doc/manual/source/protocols/tarball-fetcher.md>.
+        # AWS S3 does not not allow setting the "Link" header directly.
+        # Instead, we prefix the header with "x-amz-meta" and let Fastly
+        # rename the header for us.
+        $object_metadata->{'x-amz-meta-link'} = "<$to?rev=$rev>; rel=\"immutable\"";
+    }
+    $bucketChannels->add_key($from, "", $object_metadata)
         or die $bucketChannels->err . ": " . $bucketChannels->errstr;
 }
 
 # Update channels on channels.nixos.org.
 redirect($channelName, $releasePrefix);
-redirect("$channelName/nixexprs.tar.xz", "$releasePrefix/nixexprs.tar.xz");
+redirect("$channelName/nixexprs.tar.xz", "$releasePrefix/nixexprs.tar.xz", 1);
 redirect("$channelName/git-revision", "$releasePrefix/git-revision");
 redirect("$channelName/packages.json.br", "$releasePrefix/packages.json.br");
 redirect("$channelName/store-paths.xz", "$releasePrefix/store-paths.xz");