Private registry dependency in virtual workspace generates malformed config.toml

[Palladinium]

Describe the bug
I've tried setting up a Nix flake based on the Quick Start for a workspace, while also adding a private registry. The flake file is mostly the same as the quick start one, with the following line:

craneLib = crane.mkLib pkgs;

replaced with this, to enable a private registry (some parts redacted):

craneLibBase = crane.mkLib pkgs;
registryToken = builtins.readFile ./secrets/registry-token;
craneLib = craneLibBase.appendCrateRegistries [
  (craneLibBase.registryFromSparse {
    indexUrl = "http://host.domain:1234/index/";
    configSha256 = "<sha256>";
    fetchurlExtraArgs = {
      curlOptsList = [
        "-H"
        "Authorization: ${registryToken}"
      ];
    };
  })
];

The only other changes from the quick start example involve changing the package and crate names to match my workspace layout.

For reference, outside of Nix I normally just have this in my ~/.cargo/config.toml:

[registries]
myrepo = { index = "sparse+http://host.domain:1234/index/" }

And a corresponding credentials.toml set up. The crate in the workspace refers to its dependency as:

dependencyname = { registry = "myrepo", version = "0.1.0" }

The private registry dependencies get pulled and compiled successfully, but I run into this error:

error: builder for '/nix/store/a79k1hs64lf2s2pqnvaxs6rkh2fsh97k-cargo-package-deps-0.1.0.drv' failed with exit code 101;
       last 25 log lines:
       > Running phase: unpackPhase
       > unpacking source archive /nix/store/m7gn818lw8pzj3gpn7qyajmci7n0nl5x-source
       > source root is source
       > Running phase: patchPhase
       > Executing configureCargoCommonVars
       > Running phase: updateAutotoolsGnuConfigScriptsPhase
       > Running phase: configurePhase
       > will append /build/source/.cargo-home/config.toml with contents of /nix/store/5bm2b5cvn1ywly38mf95q2qqnmw776xq-vendor-cargo-deps/config.toml
       > default configurePhase, nothing to do
       > Running phase: buildPhase
       > ++ command cargo --version
       > cargo 1.80.0 (376290515 2024-07-16)
       > ++ command cargo check --release --locked --all-targets
       > error: could not load Cargo configuration
       >
       > Caused by:
       >   could not parse TOML configuration in `/build/source/.cargo-home/config.toml`
       >
       > Caused by:
       >   TOML parse error at line 8, column 13
       >     |
       >   8 | [source.http://host.domain:1234/index/]
       >     |             ^
       >   invalid table header
       >   expected `.`, `]`
       For full logs, run 'nix-store -l /nix/store/a79k1hs64lf2s2pqnvaxs6rkh2fsh97k-cargo-package-deps-0.1.0.drv'.
error: 1 dependencies of derivation '/nix/store/pn6vf1b6rmbp3ryi3c1p0ify9fqx4b1k-cratename-0.1.0.drv' failed to build

The config.toml in question looks like this:

[source.nix-sources-911ab032f2ab988395c534628be5bc0dd22d9ba803bf4d3780f9e3e9e5e5b994]
directory = "/nix/store/5bm2b5cvn1ywly38mf95q2qqnmw776xq-vendor-cargo-deps/911ab032f2ab988395c534628be5bc0dd22d9ba803bf4d3780f9e3e9e5e5b994"
[source.nix-sources-c19b7c6f923b580ac259164a89f2577984ad5ab09ee9d583b888f934adbbe8d0]
directory = "/nix/store/5bm2b5cvn1ywly38mf95q2qqnmw776xq-vendor-cargo-deps/c19b7c6f923b580ac259164a89f2577984ad5ab09ee9d583b888f934adbbe8d0"
[source.crates-io]
registry = "https://github.com/rust-lang/crates.io-index"
replace-with = "nix-sources-c19b7c6f923b580ac259164a89f2577984ad5ab09ee9d583b888f934adbbe8d0"
[source.http://host.domain:1234/index/]
registry = "sparse+http://host.domain:1234/index/"
replace-with = "nix-sources-911ab032f2ab988395c534628be5bc0dd22d9ba803bf4d3780f9e3e9e5e5b994"

This seems broken to me - the colon in the URL is not allowed in a key name in TOML.
I think this is emitted by this line:

crane/lib/vendorCargoRegistries.nix

Line 127 in 7e4586b

[source.${escapeShellArg name}]

Where escapeShellArg is not successfully escaping the URL because the escaping rules for TOML are more restrictive than those for Bash.

By the way, it seems odd that name is evaluating to a URL, should it perhaps be evaluating to myrepo? One thing I noticed is that the myrepo name is never associated with its URL in the Nix flake, while it is in the native setup. I presume crane can infer that from the Cargo.lock file, but I'm not sure.

It may be worth noting is that the workspace is virtual, and I had to add this to the workspace Cargo.toml to get rid of a few warnings, as crane would not find the version from the individual crates:

[workspace.package]
version = "0.1.0"

It's also very possible that I simply made a mistake somewhere, as I'm quite new to Nix. If that's the case, then I think the error message could be improved.

Reproduction
I don't have a minimal setup for reproduction yet, because it involves owning and running a private registry, which is non-trivial (the flake fails at an earlier step if the registry is unreachable). I'll work on getting a minimal repro case working from scratch soon.