[input-output-hk/cardano-sl] Issues building from source on NixOS: ignoring untrusted substituter, attribute ‘cardano-sl-static’ not found, URLs 404 (#3485)

Hey folks, I’ve been trying to build cardano-sl from source, on NixOS. I’ve ran into three small issues so far:

### 1. I had issues setting up the binary cache.
First, the [build docs](https://github.com/input-output-hk/cardano-sl/blob/master/docs/how-to/build-cardano-sl-and-daedalus-from-source-code.md) for adding the binary cache are slightly off for NixOS, where you’re discouraged from editing `/etc/nix/nix.conf` manually. Instead, `man nix.conf` explains how a user can set their own config at `~/.config/nix/nix.conf`, so I put those two build-cache configuration lines in there.

But then, I get the following error:
warning: ignoring untrusted substituter ‘https://cache.nixos.org’
warning: ignoring untrusted substituter ‘https://hydra.iohk.io’
There is some discussion of this problem on https://github.com/cachix/cachix/issues/26 , with workarounds given. I tried to follow those, but wasn’t successful. The contents of my `~/.config/nix/nix.conf` are:
jgl@n3: ~/cardano-sl $ cat ~/.config/nix/nix.conf
binary-caches = https://cache.nixos.org https://hydra.iohk.io
binary-cache-public-keys = hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=
trusted-substituters = https://cache.nixos.org https://hydra.iohk.io
trusted-users = root jgl
I kept going, just building things straight from source without the binary cache. That lead to the next two issues:

### 2. `cardano-sl-static` doesn’t seem to be a build target anymore?

The docs give the nix-build command as:
$ nix-build -A cardano-sl-static —cores 0 —max-jobs 2 —no-build-output —out-link master
but that errors with:
error: attribute ‘cardano-sl-static’ in selection path ‘cardano-sl-static’ not found
Looking in [default.nix](https://github.com/input-output-hk/cardano-sl/blob/develop/default.nix#L62), it looks like this is now called `cardano-sl-node-static`. Using that attribute seems to work.

(nit pick, why does this command specify the cores/max-jobs flags? I’ve been forgoing those for faster builds, personally. Maybe that follows some internal IOHK convention, but it seems weird to include in the public docs)

### 3. The requested URL returned error: 404 Not Found

I hit 404’s for two URLs:
(example output in [this gist](https://gist.github.com/jglukasik/3c4d487df8665b2d8ebdd1de9ee6eaf7) )

Looks like this is fallout from Debian migrating anonscm.debian.org, there is some discussion here https://github.com/NixOS/nixpkgs/issues/39927

The first 404 i was able to get past by running `nix-prefetch-url https://salsa.debian.org/debian/ca-certificates/raw/debian/20170717/mozilla/certdata2pem.py ` (from here https://github.com/cachix/cachix/issues/25 )

I haven’t been able to get past the second 404 though. The new URL for that patch seems to be https://sources.debian.org/data/main/i/intltool/0.51.0-5/debian/patches/perl5.26-regex-fixes.patch
, but the contents have changed, so the hash is different. So even if i `nix-prefetch-url`, it’ll have anew hash, which means that `nix-build` will still try and pull the old version from the URL that 404s.

However, as I was digging into this, I found that this specific issue has [already been fixed in nixpkgs](https://github.com/NixOS/nixpkgs/commit/203c8c4534c166406dac460f1b01c410a4159ffb). So I think the real issue here, is that whatever nixpkg that cardano-sl is using that has intltool as a dependency, is being pinned to version that is too old.

I tried to grok how pinning of nixpkgs is happening here, but didn’t get too far before i gave up (for example, whats the difference between `cardano-sl/fetch-nixpkgs.nix` and `cardano-sl/fetchNixpkgs.nix`?)