fetchurl: Don't wait too long for the hashed mirrors

If the hashed mirror (nixos.org/tarballs) doesn't respond in 15
seconds, give up and try the original URL.

pkgs/build-support/fetchurl/builder.sh

@@ -6,7 +6,7 @@ source $mirrorsFile
 # Curl flags to handle redirects, not use EPSV, handle cookies for
 # servers to need them during redirects, and work on SSL without a
 # certificate (this isn't a security problem because we check the
-# cryptographic hash of the output anyway). 
+# cryptographic hash of the output anyway).
 curl="curl \
  --location --max-redirs 20 \
  --retry 3
@@ -38,10 +38,11 @@ tryHashedMirrors() {
     if test -n "$NIX_HASHED_MIRRORS"; then
         hashedMirrors="$NIX_HASHED_MIRRORS"
     fi
-    
+
     for mirror in $hashedMirrors; do
         url="$mirror/$outputHashAlgo/$outputHash"
-        if $curl --fail --silent --show-error --head "$url" \
+        if $curl --retry 0 --connect-timeout "${NIX_CONNECT_TIMEOUT:-15}" \
+            --fail --silent --show-error --head "$url" \
             --write-out "%{http_code}" --output /dev/null > code 2> log; then
             tryDownload "$url"
             if test -n "$success"; then finish; fi

pkgs/build-support/fetchurl/default.nix

@@ -32,6 +32,10 @@ let
     # This variable allows the user to override hashedMirrors from the
     # command-line.
     "NIX_HASHED_MIRRORS"
+
+    # This variable allows overriding the timeout for connecting to
+    # the hashed mirrors.
+    "NIX_CONNECT_TIMEOUT"
   ] ++ (map (site: "NIX_MIRRORS_${site}") sites);
 
 in