Nix Flake for Reproducible Builds for Baochip targets

This PR adds Nix-based reproducible builds for Baochip firmware artifacts (dabao, baosec, bootloader, baremetal). Related to #57.

TODO:

• Rebase against latest main branch

What is Nix?

Nix is a package manager that provides reproducible builds by isolating dependencies and pinning exact versions. This ensures builds are identical across different machines and over time.

What's Included

• flake.nix with build derivations for all targets
• Custom Rust toolchain (1.92.0 1.93.0) with Xous targets built via rust-xous-flake
• nix develop shell with toolchains (riscv32imac-unknown-xous-elf & riscv32imac-unknown-none-elf)
• nix develop .#nightly shell with Rust nightly for cargo fmt
• GitHub Actions CI workflow (.github/workflows/nix.yml) — example run
• Deterministic build verification (nix build --rebuild)

Installing Nix

curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install

This installs Nix with flakes enabled. For other options, see Determinate Systems Nix Installer.

Building Packages

# Build the default package (dabao-helloworld)
nix build

# Build specific packages
nix build .#dabao-helloworld
nix build .#baosec
nix build .#bootloader

Build outputs are placed in a result symlink.

Available Packages

Development Shell

# Enter dev shell with stable Rust 1.92.0 + xous targets
nix develop

# Use standard cargo commands
cargo xtask dabao helloworld

# For code formatting (nightly required)
nix develop .#nightly
cargo fmt --check
cargo fmt

Verifying Reproducibility

nix build --rebuild .#dabao-helloworld

This builds twice and compares results. If they differ, it reports an error.

Challenges Solved

Custom Rust target: The riscv32imac-unknown-xous-elf target is built from source using Nix via rust-xous-flake. Note: this is not a bootstrapped build—it uses the pre-built Rust 1.92.0 compiler.

No git in Nix sandbox: The following files are patched at build time (via substituteInPlace in flake.nix) to use environment variables instead of git commands:

• tools/src/sign_image.rs — uses hardcoded version instead of SemVer::from_git()
• xtask/src/versioning.rs — reads XOUS_VERSION env var instead of git describe
• tools/src/swap_writer.rs — reads GIT_REV env var instead of git rev-parse

Reproducibility:

• Set SOURCE_DATE_EPOCH=1, CARGO_INCREMENTAL=0, and --remap-path-prefix for deterministic builds
• Modified xtask/src/versioning.rs to use SOURCE_DATE_EPOCH for the build timestamp instead of Local::now() (commit e30d405)

Dependency vendoring: Used Crane to vendor Cargo dependencies. The locales/ workspace required separate vendoring due to its own Cargo.lock.

Speeding Up Builds with Cachix (Optional)

First builds compile the Rust toolchain and can be slow. Cachix provides pre-built binaries.

Using the public cache (read-only, no account needed):

# Install cachix
nix profile install nixpkgs#cachix

# Enable the xous-core cache
cachix use xous-core

# Builds now download pre-built artifacts when available
nix build .#dabao-helloworld

To enable CI cache writes (maintainers):

1. Create account at cachix.org
2. (Optional) Create a Cachix organization for shared team ownership
3. Create public cache (e.g., xous-core)
4. Generate auth token with write access
5. Add secret: gh secret set CACHIX_AUTH_TOKEN
6. Uncomment authToken and warmup-cache sections in .github/workflows/nix.yml

A public cache is available at https://app.cachix.org/cache/xous-core (read-only for PRs from forks).

Tested

• dabao-helloworld on hardware
• boot1 on hardware
• baosec build
• bao1x-baremetal-dabao build
• CI workflow

Caveats to Consider for Reviewers

• Custom Rust target is not bootstrapped—uses pre-built Rust 1.92.0 1.93.0 compiler
• Version string (xousVersion) requires manual updates to gitTag and gitTagRevCount in flake.nix when tags change
• locales/Cargo.lock must be kept in sync separately from main Cargo.lock
• Builds run with --no-verify flag (skips signature verification) like ci (.github/workflows/build.yml) does
• Deterministic build check on CI (nix build --rebuild) runs but failures are non-blocking (continue-on-error: true)
• Only dabao, alt-boot1, boot1 have been tested on hardware
• xtask/src/versioning.rs modified to support SOURCE_DATE_EPOCH for reproducible timestamps
• Consider setting up Cachix to speed up CI builds
• Commit https://github.com/betrusted-io/xous-core/pull/777/commits/b1b05c1082bbe240fb504940075718f0d8247286 belongs to another PR is there just to help minimize cache usage on Github CI infra

Troubleshooting

"experimental features 'nix-command' and 'flakes' are disabled"

If you installed Nix without the Determinate Systems installer, add to ~/.config/nix/nix.conf:

experimental-features = nix-command flakes

Then restart your shell or run sudo systemctl restart nix-daemon (Linux).

Outdated section

Note: This section documents some parts of the development process and is kept for historical reference.