Skip to content

Commit 2fcb52e

Browse files
authored
Merge pull request #589 from pq-code-package/nix-compat
Make nix config compatible for nix version >= 2.6
2 parents 4a8ae2b + 95ff729 commit 2fcb52e

File tree

4 files changed

+213
-119
lines changed

4 files changed

+213
-119
lines changed

.github/workflows/nix.yml

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
3+
name: Nix
4+
permissions:
5+
contents: read
6+
on:
7+
push:
8+
branches: ["main"]
9+
# Only run upon changes to nix files
10+
paths:
11+
- 'flake.lock'
12+
- 'flake.nix'
13+
- 'nix/**'
14+
pull_request:
15+
branches: ["main"]
16+
# Only run upon changes to nix files
17+
paths:
18+
- 'flake.lock'
19+
- 'flake.nix'
20+
- 'nix/**'
21+
22+
concurrency:
23+
group: ${{ github.workflow }}-${{ github.ref }}
24+
cancel-in-progress: true
25+
26+
jobs:
27+
develop_environment:
28+
strategy:
29+
fail-fast: false
30+
matrix:
31+
target:
32+
- runner: ubuntu-latest
33+
container: nixos/nix:2.6.1
34+
install: 'native'
35+
- runner: ubuntu-22.04
36+
container:
37+
install: 'apt'
38+
- runner: ubuntu-24.04
39+
container:
40+
install: 'apt'
41+
- runner: macos-latest
42+
container:
43+
install: 'installer'
44+
- runner: ubuntu-20.04
45+
container:
46+
install: 'installer'
47+
- runner: ubuntu-22.04
48+
container:
49+
install: 'installer'
50+
- runner: ubuntu-24.04
51+
container:
52+
install: 'installer'
53+
name: nix setup test (${{ matrix.target.container != '' && matrix.target.container || matrix.target.runner }}, nix via ${{ matrix.target.install }})
54+
runs-on: ${{ matrix.target.runner }}
55+
if: github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork
56+
container:
57+
${{ matrix.target.container }}
58+
steps:
59+
- name: Install git
60+
shell: bash
61+
run: |
62+
if ! which git 2>&1 >/dev/null; then
63+
${{ matrix.target.container == '' && 'sudo' || '' }} apt update
64+
${{ matrix.target.container == '' && 'sudo' || '' }} apt install git -y
65+
fi
66+
- name: Manual checkout
67+
shell: bash
68+
run: |
69+
git init
70+
git config --global --add safe.directory $GITHUB_WORKSPACE
71+
git remote add origin $GITHUB_SERVER_URL/$GITHUB_REPOSITORY
72+
git fetch origin --depth 1 $GITHUB_SHA
73+
git checkout FETCH_HEAD
74+
- name: Install nix via apt
75+
if: ${{ matrix.target.install == 'apt' }}
76+
run: |
77+
${{ matrix.target.container == '' && 'sudo' || '' }} apt install nix -y
78+
- name: Install nix via installer script
79+
if: ${{ matrix.target.install == 'installer' }}
80+
shell: bash
81+
run: |
82+
sh <(curl -L https://nixos.org/nix/install) --daemon
83+
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
84+
echo "$(dirname $(which nix))" >> $GITHUB_PATH
85+
- name: nix develop
86+
run: |
87+
${{ matrix.target.install == 'apt' && 'sudo' || '' }} nix develop --experimental-features "nix-command flakes"

BUILDING.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,9 @@ There are further scripts used for development of mlkem-native, such as `format`
7171

7272
### nix setup
7373

74-
We specify the development environment for mlkem-native using nix. If you want to help develop mlkem-native, please setup nix using the [nix installer script](https://nixos.org/download/), not your package manager.
74+
We specify the development environment for mlkem-native using `nix`. If you want to help develop mlkem-native, please
75+
use `nix`. We recommend using the latest Nix version provided by the [nix installer
76+
script](https://nixos.org/download/), but we currently support all Nix versions >= 2.6.
7577

7678
All the development and build dependencies are specified in [flake.nix](flake.nix). To execute a bash shell, run
7779
```bash

flake.nix

Lines changed: 36 additions & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -17,139 +17,57 @@
1717
flake-parts.lib.mkFlake { inherit inputs; } {
1818
imports = [ ];
1919
systems = [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" "x86_64-darwin" ];
20-
perSystem = { config, pkgs, system, inputs', ... }:
20+
perSystem = { config, pkgs, system, ... }:
2121
let
22-
glibc-join = p: p.buildPackages.symlinkJoin {
23-
name = "glibc-join";
24-
paths = [ p.glibc p.glibc.static ];
25-
};
26-
27-
wrap-gcc = p: p.buildPackages.wrapCCWith {
28-
cc = p.buildPackages.gcc13.cc;
29-
bintools = p.buildPackages.wrapBintoolsWith {
30-
bintools = p.buildPackages.binutils-unwrapped;
31-
libc = glibc-join p;
32-
};
33-
};
34-
35-
native-gcc =
36-
if pkgs.stdenv.isDarwin
37-
then null
38-
else wrap-gcc pkgs;
39-
40-
# cross is for determining whether to install the cross toolchain or not
41-
core = { cross ? true }:
42-
let
43-
x86_64-gcc = wrap-gcc pkgs.pkgsCross.gnu64;
44-
aarch64-gcc = wrap-gcc pkgs.pkgsCross.aarch64-multiplatform;
45-
riscv64-gcc = wrap-gcc pkgs.pkgsCross.riscv64;
46-
aarch64_be-gcc = (pkgs.callPackage ./nix/aarch64_be-none-linux-gnu-gcc.nix { });
47-
in
48-
# NOTE:
49-
# - native toolchain should be equipped in the shell via `mkShellWithCC` (see `mkShell`)
50-
# - only install extra cross-compiled toolchains if not on darwin or `cross` is specifally set to true
51-
# - providing cross compilation toolchain (x86_64/aarch64-linux) for darwin can be cumbersome
52-
# and won't just work for now
53-
# - equip all toolchains if cross is explicitly set to true
54-
# - On some machines, `native-gcc` needed to be evaluated lastly (placed as the last element of the toolchain list), or else would result in environment variables (CC, AR, ...) overriding issue.
55-
pkgs.lib.optionals (cross && !pkgs.stdenv.isDarwin) [
56-
(pkgs.lib.optional (! pkgs.stdenv.hostPlatform.isx86_64) x86_64-gcc)
57-
(pkgs.lib.optional (! pkgs.stdenv.hostPlatform.isAarch64) aarch64-gcc)
58-
(pkgs.lib.optional (! pkgs.stdenv.hostPlatform.isRiscV64) riscv64-gcc)
59-
(pkgs.lib.optional (pkgs.stdenv.hostPlatform.isx86_64) aarch64_be-gcc)
60-
native-gcc
61-
]
62-
++ builtins.attrValues {
63-
inherit (config.packages) base;
64-
inherit (pkgs)
65-
qemu; # 8.2.4
66-
};
67-
68-
wrapShell = mkShell: attrs:
69-
mkShell (attrs // {
70-
shellHook = ''
71-
export PATH=$PWD/scripts:$PWD/scripts/ci:$PATH
72-
'' +
73-
# NOTE: we don't support nix gcc toolchains for darwin system, therefore explicitly setting environment variables like CC, AR, AS, ... is required
74-
pkgs.lib.optionalString pkgs.stdenv.isDarwin ''
75-
export CC=gcc
76-
export CXX=g++
77-
for cmd in \
78-
ar as ld nm objcopy objdump readelf ranlib strip strings size windres
79-
do
80-
export ''${cmd^^}=$cmd
81-
done
82-
'';
83-
});
84-
85-
# NOTE: idiomatic nix way of properly setting the $CC in a nix shell
86-
mkShellWithCC = cc: pkgs.mkShellNoCC.override { stdenv = pkgs.overrideCC pkgs.stdenv cc; };
87-
mkShell = mkShellWithCC native-gcc;
22+
util = pkgs.callPackage ./nix/util.nix { bitwuzla = inputs.nixpkgs-unstable.legacyPackages.${system}.bitwuzla; };
8823
in
8924
{
90-
# NOTE: hack for replacing bitwuzla in nixos-24.05 (0.4.0) to the one in nixos-unstable (0.6.0) by nix overlays
91-
_module.args.pkgs = import inputs.nixpkgs {
92-
inherit system;
93-
overlays = [
94-
(_: _: { bitwuzla = inputs'.nixpkgs-unstable.legacyPackages.bitwuzla; })
95-
];
96-
};
97-
98-
packages.linters = pkgs.buildEnv
99-
{
100-
name = "pqcp-linters";
101-
paths = builtins.attrValues {
102-
clang-tools = pkgs.clang-tools.overrideAttrs {
103-
unwrapped = pkgs.llvmPackages_17.clang-unwrapped;
104-
};
25+
packages.cbmc = util.cbmc;
10526

106-
inherit (pkgs)
107-
nixpkgs-fmt
108-
shfmt;
109-
110-
inherit (pkgs.python3Packages)
111-
black;
112-
};
113-
};
114-
115-
packages.cbmc = pkgs.callPackage ./nix/cbmc { }; # 6.4.1
116-
117-
packages.base = pkgs.buildEnv {
118-
name = "pqcp-base";
119-
paths = builtins.attrValues {
120-
inherit (pkgs.python3Packages)
121-
pyyaml
122-
python
123-
click;
124-
};
125-
};
126-
127-
devShells.default = wrapShell mkShell {
27+
devShells.default = util.wrapShell util.mkShell {
12828
packages =
129-
core { } ++
29+
util.core { } ++
30+
util.linters ++
13031
builtins.attrValues
13132
{
132-
inherit (config.packages) linters cbmc;
33+
inherit (config.packages) cbmc;
13334
inherit (pkgs)
13435
direnv
13536
nix-direnv;
13637
};
13738
};
13839

139-
devShells.ci = wrapShell mkShell { packages = core { cross = false; }; };
140-
devShells.ci-cross = wrapShell mkShell { packages = core { }; };
141-
devShells.ci-cbmc = wrapShell mkShell { packages = core { cross = false; } ++ [ config.packages.cbmc ]; };
142-
devShells.ci-cbmc-cross = wrapShell mkShell { packages = core { } ++ [ config.packages.cbmc ]; };
143-
devShells.ci-linter = wrapShell pkgs.mkShellNoCC { packages = [ config.packages.linters ]; };
144-
145-
devShells.ci_clang18 = wrapShell (mkShellWithCC pkgs.clang_18) { packages = [ config.packages.base ]; };
146-
devShells.ci_gcc48 = wrapShell (mkShellWithCC pkgs.gcc48) { packages = [ config.packages.base ]; };
147-
devShells.ci_gcc49 = wrapShell (mkShellWithCC pkgs.gcc49) { packages = [ config.packages.base ]; };
148-
devShells.ci_gcc7 = wrapShell (mkShellWithCC pkgs.gcc7) { packages = [ config.packages.base ]; };
149-
devShells.ci_gcc11 = wrapShell (mkShellWithCC pkgs.gcc11) { packages = [ config.packages.base ]; };
150-
devShells.ci_gcc14 = wrapShell (mkShellWithCC pkgs.gcc14) { packages = [ config.packages.base ]; };
40+
devShells.ci = util.wrapShell util.mkShell { packages = util.core { cross = false; }; };
41+
devShells.ci-cross = util.wrapShell util.mkShell { packages = util.core { }; };
42+
devShells.ci-cbmc = util.wrapShell util.mkShell { packages = util.core { cross = false; } ++ [ config.packages.cbmc ]; };
43+
devShells.ci-cbmc-cross = util.wrapShell util.mkShell { packages = util.core { } ++ [ config.packages.cbmc ]; };
44+
devShells.ci-linter = util.wrapShell pkgs.mkShellNoCC { packages = util.linters; };
45+
46+
devShells.ci_clang18 = util.wrapShell (util.mkShellWithCC pkgs.clang_18) { packages = [ pkgs.python3 ]; };
47+
devShells.ci_gcc48 = util.wrapShell (util.mkShellWithCC pkgs.gcc48) { packages = [ pkgs.python3 ]; };
48+
devShells.ci_gcc49 = util.wrapShell (util.mkShellWithCC pkgs.gcc49) { packages = [ pkgs.python3 ]; };
49+
devShells.ci_gcc7 = util.wrapShell (util.mkShellWithCC pkgs.gcc7) { packages = [ pkgs.python3 ]; };
50+
devShells.ci_gcc11 = util.wrapShell (util.mkShellWithCC pkgs.gcc11) { packages = [ pkgs.python3 ]; };
51+
devShells.ci_gcc14 = util.wrapShell (util.mkShellWithCC pkgs.gcc14) { packages = [ pkgs.python3 ]; };
15152
};
15253
flake = {
54+
devShell.x86_64-linux =
55+
let
56+
pkgs = inputs.nixpkgs.legacyPackages.x86_64-linux;
57+
pkgs-unstable = inputs.nixpkgs-unstable.legacyPackages.x86_64-linux;
58+
util = pkgs.callPackage ./nix/util.nix {
59+
inherit pkgs;
60+
bitwuzla = pkgs-unstable.bitwuzla;
61+
};
62+
in
63+
util.wrapShell util.mkShell {
64+
packages =
65+
util.core { } ++
66+
util.linters ++
67+
[
68+
util.cbmc
69+
];
70+
};
15371
# The usual flake attributes can be defined here, including system-
15472
# agnostic ones like nixosModule and system-enumerating ones, although
15573
# those are more easily expressed in perSystem.

nix/util.nix

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
3+
{ pkgs, bitwuzla }:
4+
rec {
5+
glibc-join = p: p.buildPackages.symlinkJoin {
6+
name = "glibc-join";
7+
paths = [ p.glibc p.glibc.static ];
8+
};
9+
10+
wrap-gcc = p: p.buildPackages.wrapCCWith {
11+
cc = p.buildPackages.gcc13.cc;
12+
bintools = p.buildPackages.wrapBintoolsWith {
13+
bintools = p.buildPackages.binutils-unwrapped;
14+
libc = glibc-join p;
15+
};
16+
};
17+
18+
native-gcc =
19+
if pkgs.stdenv.isDarwin
20+
then null
21+
else wrap-gcc pkgs;
22+
23+
# cross is for determining whether to install the cross toolchain or not
24+
core = { cross ? true }:
25+
let
26+
x86_64-gcc = wrap-gcc pkgs.pkgsCross.gnu64;
27+
aarch64-gcc = wrap-gcc pkgs.pkgsCross.aarch64-multiplatform;
28+
riscv64-gcc = wrap-gcc pkgs.pkgsCross.riscv64;
29+
aarch64_be-gcc = (pkgs.callPackage ./aarch64_be-none-linux-gnu-gcc.nix { });
30+
in
31+
# NOTE:
32+
# - native toolchain should be equipped in the shell via `mkShellWithCC` (see `mkShell`)
33+
# - only install extra cross-compiled toolchains if not on darwin or `cross` is specifally set to true
34+
# - providing cross compilation toolchain (x86_64/aarch64-linux) for darwin can be cumbersome
35+
# and won't just work for now
36+
# - equip all toolchains if cross is explicitly set to true
37+
# - On some machines, `native-gcc` needed to be evaluated lastly (placed as the last element of the toolchain list), or else would result in environment variables (CC, AR, ...) overriding issue.
38+
pkgs.lib.optionals (cross && !pkgs.stdenv.isDarwin) [
39+
(pkgs.lib.optional (! pkgs.stdenv.isx86_64) x86_64-gcc)
40+
(pkgs.lib.optional (! pkgs.stdenv.isAarch64) aarch64-gcc)
41+
(pkgs.lib.optional (pkgs.stdenv.isx86_64 || pkgs.stdenv.isAarch64) riscv64-gcc)
42+
(pkgs.lib.optional (pkgs.stdenv.isx86_64) aarch64_be-gcc)
43+
native-gcc
44+
]
45+
++ builtins.attrValues {
46+
inherit (pkgs)
47+
python3
48+
qemu; # 8.2.4
49+
};
50+
51+
wrapShell = mkShell: attrs:
52+
mkShell (attrs // {
53+
shellHook = ''
54+
export PATH=$PWD/scripts:$PWD/scripts/ci:$PATH
55+
'' +
56+
# NOTE: we don't support nix gcc toolchains for darwin system, therefore explicitly setting environment variables like CC, AR, AS, ... is required
57+
pkgs.lib.optionalString pkgs.stdenv.isDarwin ''
58+
export CC=gcc
59+
export CXX=g++
60+
for cmd in \
61+
ar as ld nm objcopy objdump readelf ranlib strip strings size windres
62+
do
63+
export ''${cmd^^}=$cmd
64+
done
65+
'';
66+
});
67+
68+
# NOTE: idiomatic nix way of properly setting the $CC in a nix shell
69+
mkShellWithCC = cc: pkgs.mkShellNoCC.override { stdenv = pkgs.overrideCC pkgs.stdenv cc; };
70+
mkShell = mkShellWithCC native-gcc;
71+
72+
linters =
73+
builtins.attrValues {
74+
clang-tools = pkgs.clang-tools.overrideAttrs {
75+
unwrapped = pkgs.llvmPackages_17.clang-unwrapped;
76+
};
77+
78+
inherit (pkgs)
79+
nixpkgs-fmt
80+
shfmt;
81+
82+
inherit (pkgs.python3Packages)
83+
black;
84+
};
85+
86+
cbmc = pkgs.callPackage ./cbmc { inherit bitwuzla; };
87+
}

0 commit comments

Comments
 (0)