while studying cargo index format, I realized a cursed thing: I could probably get this thing working with Nix to fetch crates without using Cargo...

i'm probably reinventing the wheel (the wheel being naersk), but:

let
  # assuming cwd = `git clone github.com/rust-lang/crates.io-index`
  fetchCrateVersions = name: builtins.readFile ./${builtins.substring 0 2 name}/${builtins.substring 2 4 name}/${name};
  fetchCrateMetadata = name: version: builtins.getAttr version (builtins.listToAttrs (builtins.map (c: { name = c.vers; value = c; }) (builtins.map builtins.fromJSON (builtins.filter (n: n != "") (nixpkgs.lib.strings.splitString "\n" (fetchCrateVersions name))))));
in
# `fetchCrateMetadata`'s output contains `cksum` attribute matching SHA256 hash of the crate, allowing for a fixed-output derivation.
# Using recursive calls of a hypothetical function, all dependencies of a certain crate could be found, and a list for calling `fetchurl` created.
# Creating such a recursive function is an exercise for the reader.

Thus, the entire crates.io registry becomes accessible, and a hypothetical Cargo.lock file could be used as a starting point to discover dependencies for a project, without the requirement for any sort of hashes.