proper building on nix

.gitignore

@@ -8,3 +8,4 @@ zig-out
 lightpanda.id
 /src/rust/target/
 src/snapshot.bin
+result

nix/package.nix

@@ -10,51 +10,16 @@
   buildInputs ? [ ],
 }:
 let
-  installAction = src + "/.github/actions/install/action.yml";
-  # Same awk Makefile uses to read these defaults, so the two never drift apart.
-  v8VersionFile = pkgs.runCommand "lightpanda-v8-version" { } ''
-    awk -F\' '/^  v8:/{f=1} f&&/default:/{print $2; exit}' ${installAction} > $out
-  '';
-  zigV8TagFile = pkgs.runCommand "lightpanda-zig-v8-tag" { } ''
-    awk -F\' '/^  zig-v8:/{f=1} f&&/default:/{print $2; exit}' ${installAction} > $out
-  '';
-
-  v8Version = lib.removeSuffix "\n" (builtins.readFile v8VersionFile);
-  v8Tag = lib.removeSuffix "\n" (builtins.readFile zigV8TagFile);
-
-  v8Archives = {
-    aarch64-darwin = {
-      platform = "macos_aarch64";
-      hash = "sha256-AOXAPuMHof5uA+F3EdXyqzy3jTc1vJvFLJT4txzLBhg=";
-    };
-    x86_64-darwin = {
-      platform = "macos_x86_64";
-      hash = "sha256-q7y6djJ7ddXWWKNZId56cD2fSI+Ih7a+NI9ZhNQjOwQ=";
-    };
-    aarch64-linux = {
-      platform = "linux_aarch64";
-      hash = "sha256-Bk0Hna4tfLov6iKTYErpZLnqj3Q7eEeqfymPyvrUtjU=";
-    };
-    x86_64-linux = {
-      platform = "linux_x86_64";
-      hash = "sha256-7tD6GpfYFeL1AA56KRU9YuBu+S0tgKAkWYcBOU6TIss=";
-    };
-  };
-  v8Archive = v8Archives.${stdenv.hostPlatform.system};
+  # Generated by nix/update-v8-deps.sh from the defaults in
+  # .github/actions/install/action.yml — rerun that script when those change.
+  v8Deps = import ./v8-deps.nix;
+  v8Archive = v8Deps.archives.${stdenv.hostPlatform.system};
 
   v8 = fetchurl {
-    url = "https://github.com/lightpanda-io/zig-v8-fork/releases/download/${v8Tag}/libc_v8_${v8Version}_${v8Archive.platform}.a";
+    url = "https://github.com/lightpanda-io/zig-v8-fork/releases/download/${v8Deps.tag}/libc_v8_${v8Deps.version}_${v8Archive.platform}.a";
     hash = v8Archive.hash;
   };
 
-  zigDeps = zig.fetchDeps {
-    inherit src version;
-    name = "lightpanda";
-    # Whenever build.zig.zon is updated, this must be updated too.
-    hash = "sha256-VEb7BpVQ2CEj6KYQLidlWJYDqrwUDDJKXFtxZxBbuQs=";
-  };
-
-  rustFfiLib = "liblightpanda_ffi.a";
   rustLib = craneLib.buildPackage {
     pname = "lightpanda-ffi";
     inherit version;
@@ -62,30 +27,80 @@ let
     cargoExtraArgs = "-p lightpanda-ffi";
     doCheck = false;
   };
+  rustFfiLib = "${rustLib}/lib/liblightpanda_ffi.a";
+
+  zigDeps =
+    pkgs.runCommand "lightpanda-zig-deps"
+      {
+        nativeBuildInputs = [ zig ];
+        outputHash = "sha256-O25mwh9d+nU95cL2T6CMqj735f4rIbNoHumhg9CiGeQ=";
+        outputHashMode = "recursive";
+      }
+      ''
+        cp -r --no-preserve=mode ${src} source
+        cd source
+
+        export ZIG_GLOBAL_CACHE_DIR="$PWD/zig-cache"
+        export ZIG_LOCAL_CACHE_DIR="$ZIG_GLOBAL_CACHE_DIR"
+
+        TERM=dumb zig build --fetch=all
+
+        mkdir -p "$ZIG_GLOBAL_CACHE_DIR/p"
+        cp -r "$ZIG_GLOBAL_CACHE_DIR/p" "$out"
+      '';
+
+  zigTargetTriple = "${stdenv.hostPlatform.parsed.cpu.name}-${stdenv.hostPlatform.parsed.kernel.name}-${stdenv.hostPlatform.parsed.abi.name}";
 in
-zig.makePackage {
-  inherit stdenv src zigDeps;
-  __structuredAttrs = true;
+stdenv.mkDerivation {
   pname = "lightpanda";
   version = "${version}-nix";
+  inherit src;
 
   nativeBuildInputs = buildInputs ++ [
     pkgs.autoPatchelfHook
   ];
 
-  zigReleaseMode = "fast";
-  zigFlagsArray = [
-    "-Dtarget=${stdenv.hostPlatform.parsed.cpu.name}-${stdenv.hostPlatform.parsed.kernel.name}-${stdenv.hostPlatform.parsed.abi.name}"
-    "-Dprebuilt_v8_path=${v8}"
-    "-Dprebuilt_rust_path=${rustLib}/lib/${rustFfiLib}"
-    "-Dversion=${version}"
-  ];
+  configurePhase = ''
+    runHook preConfigure
+
+    export HOME="$TMPDIR/home"
+    mkdir -p "$HOME"
+
+    export ZIG_GLOBAL_CACHE_DIR="$TMPDIR/zig-global-cache"
+    export ZIG_LOCAL_CACHE_DIR="$ZIG_GLOBAL_CACHE_DIR"
+    mkdir -p "$ZIG_GLOBAL_CACHE_DIR"
+    cp -r --no-preserve=mode ${zigDeps}/. "$ZIG_GLOBAL_CACHE_DIR/p"
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    TERM=dumb zig build \
+      -Doptimize=ReleaseFast \
+      -Dtarget=${zigTargetTriple} \
+      -Dprebuilt_v8_path=${v8} \
+      -Dprebuilt_rust_path=${rustFfiLib} \
+      -Dversion=${version}
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp zig-out/bin/lightpanda $out/bin/lightpanda
+
+    runHook postInstall
+  '';
 
   meta = {
     description = "Headless browser designed for AI and automation";
     homepage = "https://lightpanda.io";
     license = lib.licenses.agpl3Only;
     mainProgram = "lightpanda";
-    platforms = builtins.attrNames v8Archives;
+    platforms = builtins.attrNames v8Deps.archives;
   };
 }

nix/update-v8-deps.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+ACTION=.github/actions/install/action.yml
+OUT=nix/v8-deps.nix
+
+V8_VERSION=$(awk -F\' '/^  v8:/{f=1} f&&/default:/{print $2; exit}' "$ACTION")
+ZIG_V8_TAG=$(awk -F\' '/^  zig-v8:/{f=1} f&&/default:/{print $2; exit}' "$ACTION")
+
+declare -A PLATFORMS=(
+  [aarch64-darwin]=macos_aarch64
+  [x86_64-darwin]=macos_x86_64
+  [aarch64-linux]=linux_aarch64
+  [x86_64-linux]=linux_x86_64
+)
+
+echo "v8 ${V8_VERSION} @ ${ZIG_V8_TAG}"
+
+workdir=$(mktemp -d)
+trap 'rm -rf "$workdir"' EXIT
+
+fetch_one() {
+  local system="$1" platform="$2"
+  local url="https://github.com/lightpanda-io/zig-v8-fork/releases/download/${ZIG_V8_TAG}/libc_v8_${V8_VERSION}_${platform}.a"
+  local tmp="$workdir/$system.a"
+  echo "  fetching ${system} (${platform})..." >&2
+  curl -fsSL "$url" -o "$tmp"
+  local sha256 hash
+  sha256=$(sha256sum "$tmp" | cut -d' ' -f1)
+  hash=$(nix hash convert --hash-algo sha256 --to sri "$sha256")
+  rm -f "$tmp"
+  {
+    echo "    ${system} = {"
+    echo "      platform = \"${platform}\";"
+    echo "      hash = \"${hash}\";"
+    echo "    };"
+  } > "$workdir/$system.nix"
+}
+
+pids=()
+for system in "${!PLATFORMS[@]}"; do
+  fetch_one "$system" "${PLATFORMS[$system]}" &
+  pids+=("$!")
+done
+for pid in "${pids[@]}"; do
+  wait "$pid"
+done
+
+{
+  echo "# Generated by nix/update-v8-deps.sh — do not edit by hand."
+  echo "{"
+  echo "  version = \"${V8_VERSION}\";"
+  echo "  tag = \"${ZIG_V8_TAG}\";"
+  echo "  archives = {"
+  for system in "${!PLATFORMS[@]}"; do
+    cat "$workdir/$system.nix"
+  done
+  echo "  };"
+  echo "}"
+} > "$OUT"
+
+echo "wrote ${OUT}"

nix/v8-deps.nix

@@ -0,0 +1,23 @@
+# Generated by nix/update-v8-deps.sh — do not edit by hand.
+{
+  version = "15.5.35.13";
+  tag = "v0.5.9";
+  archives = {
+    aarch64-linux = {
+      platform = "linux_aarch64";
+      hash = "sha256-MO3rVuyDdDZMy7UJZfxmcfPJWt35gLNn1r1O+dls3jQ=";
+    };
+    x86_64-linux = {
+      platform = "linux_x86_64";
+      hash = "sha256-7tD6GpfYFeL1AA56KRU9YuBu+S0tgKAkWYcBOU6TIss=";
+    };
+    x86_64-darwin = {
+      platform = "macos_x86_64";
+      hash = "sha256-0OI6ZYicAAozz8kEjzo19VppxrBtZQZ8d1yuGQaMoqU=";
+    };
+    aarch64-darwin = {
+      platform = "macos_aarch64";
+      hash = "sha256-3BQCflPfiROZUi9giSlqz983IHr6yh5J3QXERtP8R18=";
+    };
+  };
+}