nix: try using sccache

Why: the original `rustBuildIncremental` actually produces bad output
     in some cases.

(1) it purely relies on `cargo` incremental build correctness
(2) nix flakes copies the repo source to the /nix/store.
(3) for reproducibility, everything in /nix/store has mtime == 1970-01-01.
(4) cargo's rebuild checking only looks at the file mtime, so we get false
    negatives (cargo believes the file is unchanged when it is actually
    different).

Relevant issue:
[cargo - fingerprint by hash instead of mtime](rust-lang/cargo#6529)

Introducing sccache:

`sccache` caches individual `rustc` invocations and stores the results
in `$SCCACHE_DIR = /var/cache/lexe/sccache`. Using `sccache`:

- cached builds are about 0.4-0.5x time (faster)
- uncached builds are about 1.1-1.2x time (extra overhead)
- sccache sadly can't cache proc-macro crates...

Author: phlip9

README.md

@@ -289,21 +289,20 @@ $ orb shell -m linux-builder
 bdd9eec1fbd625eec3b2a9e2a6072f60240c930b0867b47199730b320c148e8c
 ```
 
-## Fast incremental cargo builds in `nix`
+## (Optional) Faster `nix` cargo rebuilds
 
 Follow these steps if:
 
 - You're an engineer working on the rust+nix build.
 - You're running `nix build` a lot and want faster incremental cargo builds.
 
-Once setup, [`buildRustIncremental`](./nix/pkgs/buildRustIncremental.nix) will
-make incremental Rust builds MUCH faster. However, avoid using
-`buildRustIncremental` for reproducibility-critical packages like the SGX
-enclaves.
+Once setup, [`buildRustSccache`](./nix/pkgs/buildRustSccache.nix) will make
+incremental Rust rebuilds faster. However, avoid using `buildRustSccache`
+for reproducibility-critical packages like the SGX enclaves.
 
 To get this working, we give the nix build sandbox access to a shared, global
-cargo `target/` directory so we can fully reuse intermediate cargo build
-artifacts across `nix build` invocations.
+directory so that `sccache` can reuse already-built `rustc` compilation
+artifacts across different nix builds.
 
 If you're using the `linux-builder` VM, then skip this; it's already setup for
 you.
@@ -323,9 +322,6 @@ $ echo "extra-sandbox-paths = /private/var/cache/lexe" | sudo tee -a /etc/nix/ni
 $ sudo launchctl kickstart -k system/org.nixos.nix-daemon
 ```
 
-NOTE: you'll want to run `sudo rm -rf /var/cache/lexe/target` periodically, just
-like `cargo clean`.
-
 Here we're creating a new `/var/cache/lexe` directory that's only accessible to
 members of the `nixbld` group. We also set some special file settings so that
 all new files and directories created in `/var/cache/lexe` are automatically

nix/lib/default.nix

@@ -70,4 +70,25 @@
     ref = elemAt matches 0;
     rev = elemAt matches 1;
   };
+
+  # In a string `inputStr`, replace all matches of `regex` with `replacement`.
+  #
+  # ```
+  # > inputStr = "--package=run-sgx --bin=run-sgx --locked --offline"
+  # > regexReplaceAll "--bin( |=)[^ ]+" "" inputStr
+  # "--package=run-sgx  --locked --offline"
+  # ```
+  regexReplaceAll = regex: replacement: inputStr: let
+    inherit (builtins) concatStringsSep isString map split;
+
+    # ex: inputStr = "foo bar baz", regex = "bar" => [ "foo " ["bar"] " baz" ]
+    splits = split regex inputStr;
+
+    matchesReplaced = map (s:
+      if isString s
+      then s
+      else replacement)
+    splits;
+  in
+    concatStringsSep "" matchesReplaced;
 }