flake.nix
Fil-C wrapped as a Nix stdenv
Modified nixpkgs with Fil-C cross-compilation support filc-aarch64: 118d872 plus aarch64 in the gnufilc0 ABI assertion.
For the example finix machine and its test (finix/demo.nix). The last revision before finix required finit 5; filnix's Nixpkgs has finit 4.17.
The system-independent outputs (overlays, NixOS modules and machines) come from x86_64-linux; everything keyed by system comes from both.
The Fil-C package set. blockRustGo marks Rust and Go packages broken (lib/block-rust-go.nix); crossOverlays apply after the ports.
| staging | default false |
| blockRustGo | default false |
| crossOverlays | default [ ] |
| permittedInsecurePackages | default [ ] |
tzdata's now.ck compares zones from the build date on, so 2026c fails it from 2026-11-01 (Vancouver and Phoenix agree from then). It lints the data, not zic or zdump; run the rest.
The package set of a whole Fil-C system (lib/filc-system.nix): Rust and Go refused, and the native exceptions taken from a native Nixpkgs, the built-in ones for os and those native picks from it.
| os | |
| native | default _: { } |
| nativePackages | default pkgs |
| nativeNix | default true |
Shared by every system that adds no exceptions of its own.
Explicit reproduction outputs only; the ordinary package set still refuses this vulnerable PHP unless the caller opts in.
On staging, the PostgreSQL server marks its main segment with zmark_shared and is built with -fzmark-shared (docs/zmark-shared.md). Release systems still refuse it (lib/block-rust-go.nix).
Ruby with individual gems for testing - auto-generated for all available gems
Fil-C docs, pass and runtime at the pin, for reading (lib/sources.nix): nix build .#lib.x86_64-linux.filc-ref-src
checks.nanofil with arguments, such as { shard = "2/6"; } or { withTrealla = true; } (.github/workflows/nanofil.yml).
Unsupported ports and known release gaps stay strict and opt-in, outside the ordinary passing contract of flake check.
Bare ports that land on another attribute than the one written.
The extracted validator on every -O module of the corpus, hello, zlib, Lua and SQLite (.github/workflows/nanofil-gate.yml).
Programs linked with nanofil's IR of user glibc, proved (nanofil/docs/glibc-ir.md); off the main path.
The same backend extracted to C++ by Crane.
Hello's linked checked module, the Iris proof's fixture.
The StealMyBitcoin exploit works end to end on the unstripped Nixpkgs PHP 8.4.25 and is thwarted by pkgsFilc.php84_25, the same vulnerable release under Fil-C (docs/php.md).
Boots the exact nixos-image file and checks its userland.
Boots finixConfigurations.filc-demo; see finix/test.nix.
A NixOS or finix system whose pkgs is the Fil-C package set; see lib/filc-system.nix and docs/nixos.md.
A Fil-C NixOS, with the NixOS modules of filnix's own Nixpkgs: the Fil-C ports (systemd's above all) are built and tested against those, not against another release's.
The base machine of the images; see nixos/base.nix.
The same machine on EC2, for the public AMI; see nixos/amazon.nix.
https://filc.less.rest, on that AMI; see nixos/demo-wiki.nix.
The finix machine with a Fil-C userland; see finix/demo.nix.
Export the full cross-compiled package sets
A package set, not a derivation; .#rubyWithGem.<gem> still works.
NixOS VM tests of Fil-C systems; see tests/nixos/default.nix.
The base Fil-C NixOS as a compressed qcow2, and a VM that boots it (nixos/image.nix).
Fil-C, runtime and native ELF files in a closure (docs/nixos.md).
Vulnerable PHP for reproductions, never the default or :latest.
Experimental: opcache's JIT, compiled through C (docs/php.md).
Native against Fil-C PHP 8.5 on real applications (bench/php).
PHP 8.5 with the same JIT, on the staging toolchain.
The GitHub Pages site: pages/ and the rendered docs/.
The site's SWI-Prolog 10, which nixpkgs does not have; ship publishes it so the Pages build substitutes it.
The site's nanofil playground, built with the staging toolchain; ship publishes it so Pages does not rebuild staging clang.
The PostgreSQL server with -fzmark-shared (docs/zmark-shared.md), staging only; the campaign builds it (scripts/ci-outputs.txt).
Release alternates on the staging toolchain: unreleased compiler and runtime changes, faster but less reviewed (docs/php.md).
Full Fil-C compilation environment (opt-in with 'nix develop .#world')
Incremental Fil-C LLVM hacking; see docs/llvm-dev.md
Fil-C is Linux-only, but Macs still run the git hooks and scripts/ship (which builds through a Linux builder or the publisher host), so they get the host tools those need and the default dev shell.
What scripts/git-hooks and scripts/ship run, so that they work without nix develop.