flake.nix
Fil-C wrapped as a Nix stdenv
Modified nixpkgs with Fil-C cross-compilation support filc-aarch64: 118d872 plus aarch64 in the gnufilc0 ABI assertion.
For the example finix machine and its test (finix/demo.nix). The last revision before finix required finit 5; filnix's Nixpkgs has finit 4.17.
The system-independent outputs (overlays, NixOS modules and machines) come from x86_64-linux; everything keyed by system comes from both.
The Fil-C package set. blockRustGo marks Rust and Go packages broken (lib/block-rust-go.nix); crossOverlays apply after the ports.
| staging | default false |
| blockRustGo | default false |
| crossOverlays | default [ ] |
| permittedInsecurePackages | default [ ] |
tzdata's now.ck compares zones from the build date on, so 2026c fails it from 2026-11-01 (Vancouver and Phoenix agree from then). It lints the data, not zic or zdump; run the rest.
The package set of a whole Fil-C system (lib/filc-system.nix): Rust and Go refused, and the native exceptions taken from a native Nixpkgs, the built-in ones for os and those native picks from it.
| os | |
| native | default _: { } |
| nativePackages | default pkgs |
| nativeNix | default true |
Shared by every system that adds no exceptions of its own.
Explicit reproduction outputs only; the ordinary package set still refuses this vulnerable PHP unless the caller opts in.
On staging, the PostgreSQL server marks its main segment with zmark_shared and is built with -fzmark-shared (docs/zmark-shared.md). Release systems still refuse it (lib/block-rust-go.nix).
Ruby with individual gems for testing - auto-generated for all available gems
Fil-C docs, pass and runtime at the pin, for reading (lib/sources.nix): nix build .#lib.x86_64-linux.filc-ref-src
checks.nanofil with arguments, such as { shard = "2/6"; } or { withTrealla = true; } (.github/workflows/nanofil.yml).
Unsupported ports and known release gaps stay strict and opt-in, outside the ordinary passing contract of flake check.
Bare ports that land on another attribute than the one written.
Hello's linked checked module, the Iris proof's fixture.
The StealMyBitcoin exploit works end to end on the unstripped Nixpkgs PHP 8.4.25 and is thwarted by pkgsFilc.php84_25, the same vulnerable release under Fil-C (docs/php.md).
Boots the exact nixos-image file and checks its userland.
Boots finixConfigurations.filc-demo; see finix/test.nix.
A NixOS or finix system whose pkgs is the Fil-C package set; see lib/filc-system.nix and docs/nixos.md.
A Fil-C NixOS, with the NixOS modules of filnix's own Nixpkgs: the Fil-C ports (systemd's above all) are built and tested against those, not against another release's.
The base machine of the images; see nixos/base.nix.
The same machine on EC2, for the public AMI; see nixos/amazon.nix.
https://filc.less.rest, on that AMI; see nixos/demo-wiki.nix.
The finix machine with a Fil-C userland; see finix/demo.nix.
Export the full cross-compiled package sets
A package set, not a derivation; .#rubyWithGem.<gem> still works.
NixOS VM tests of Fil-C systems; see tests/nixos/default.nix.
The base Fil-C NixOS as a compressed qcow2, and a VM that boots it (nixos/image.nix).
Fil-C, runtime and native ELF files in a closure (docs/nixos.md).
Vulnerable PHP for reproductions, never the default or :latest.
Experimental: opcache's JIT, compiled through C (docs/php.md).
Native against Fil-C PHP 8.5 on real applications (bench/php).
PHP 8.5 with the same JIT, on the staging toolchain.
The GitHub Pages site: pages/ and the rendered docs/.
The site's SWI-Prolog 10, which nixpkgs does not have; ship publishes it so the Pages build substitutes it.
The site's nanofil playground, built with the staging toolchain; ship publishes it so Pages does not rebuild staging clang.
The PostgreSQL server with -fzmark-shared (docs/zmark-shared.md), staging only; the campaign builds it (scripts/ci-outputs.txt).
Release alternates on the staging toolchain: unreleased compiler and runtime changes, faster but less reviewed (docs/php.md).
Full Fil-C compilation environment (opt-in with 'nix develop .#world')
Incremental Fil-C LLVM hacking; see docs/llvm-dev.md
Fil-C is Linux-only, but Macs still run the git hooks and scripts/ship (which builds through a Linux builder or the publisher host), so they get the host tools those need and the default dev shell.
What scripts/git-hooks and scripts/ship run, so that they work without nix develop.